View online: https://www.drupal.org/sa-contrib-2026-227 Project: Dopup [1] Project machine name: dopup Date: 2026-October-21 Security risk: *Critical* 15 ∕ 25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Information disclosure Affected versions: <1.0.7 CVE IDs: CVE-2026-114530 Description:  The Dopup module provides functionality for selecting and working with Webforms. The module does not perform sufficient entity access checking in some cases and may expose the title of private Webforms. Solution:  Install the latest version: * If you use the dopup module, upgrade to Dopup 1.0.7 [3] Reported By:  * Marcus Johansson (marcus_johansson) [4] * Rodel Duterte (rduterte) [5] Fixed By:  * Rodel Duterte (rduterte) [6] Coordinated By:  * Swan Kalata (akalata) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team * Pierre Rudloff (prudloff) [10] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/dopup [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/dopup/releases/1.0.7 [4] https://www.drupal.org/u/marcus_johansson [5] https://www.drupal.org/u/rduterte [6] https://www.drupal.org/u/rduterte [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/poker10 [10] https://www.drupal.org/u/prudloff [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....