DRUPAL-CONTRIB-2026-292

This module allows for direct viewing of a file with the URL alias. This is a followup advisory to SA-CONTRIB-2026-245, which did not fully resolve the underlying vulnerability. In some cases, files may be served with the HTTP header Cache-Control: public when they should be uncacheable. This can...

DRUPAL-CONTRIB-2026-291

This module enables you to share and reuse content across websites. The module did not sufficiently encrypt the password of the system user used when synchronizing content. This can potentially allow unprivileged users to view the password. This vulnerability is mitigated by the fact that an...

DRUPAL-CONTRIB-2026-290

This module lets you manage system-wide OAuth2 access and refresh tokens for Box, Quip, and Slack integrations through Drush and an OAuth2 validation callback. The module doesn't restrict access to its OAuth2 routes, allowing an an anonymous visitor to potentially connect the site's integration t...

DRUPAL-CONTRIB-2026-289

The Field Permissions module enables you to set field-level permissions for viewing and editing fields, including a "Private" setting. The module does not sufficiently restrict access to "Private" fields on entity types that have no field for an author user account or owner. As a result, a field...

DRUPAL-CONTRIB-2026-288

This module enables you to set field-level permissions to create, update or view individual fields. The module does not sufficiently verify administrative privileges when checking access to protected fields, potentially allowing users with a role named administrator to bypass field-level access...

DRUPAL-CONTRIB-2026-287

The module enables authentication via the OpenID Connect oAuth2 protocol. When a new user logs in via OpenID Connect, the module tries to link the user to an existing account with the same email address. Doing so it allows to take over any existing Drupal account except user 1 that has not yet be...

DRUPAL-CONTRIB-2026-286

Stage File Proxy is a general solution for getting production files on a development server on demand. It is not intended for usage on production sites. The module doesn't sufficiently check file URL for malicious content when attempting to do fallback retrieval leading to a cross-site scripting...

DRUPAL-CONTRIB-2026-285

This module enables users to create and save signatures as SVG images. The module did not sufficiently sanitize user-supplied content before saving it to the public file system. Under certain scenarios, a maliciously crafted file could contain active or otherwise unsafe content and may result in ...

DRUPAL-CONTRIB-2026-284

This module enables you to log in to your Drupal site using any OAuth 2.0 or OpenID Connect compliant identity provider. The module doesn't sufficiently check access on a configuration route, or check whether the identity provider has verified the email address it returns. Together, these let an...

DRUPAL-CONTRIB-2026-280

This module provides a bulk form for assigning or removing roles on multiple user accounts at once. The bulk update form does not prevent access to users who do not have permission to assign roles. This vulnerability is mitigated by the fact that an attacker must have a role with the permission...

DRUPAL-CONTRIB-2026-279

S3 File System s3fs provides an additional file system to your Drupal site that stores files in Amazon's Simple Storage Service S3 storage. The module doesn't sufficiently isolate upload context between separate objectfile operations in the same request resulting in the potential for objects to b...

DRUPAL-CONTRIB-2026-283

This module enables you to quickly toggle the publication status, promotion and stickiness of nodes, and the publication status of comments, from links on the page. The module doesn't sufficiently protect against cross-site request forgery CSRF on its toggle URL, under the scenario where a user...

DRUPAL-CONTRIB-2026-282

This module enables you to quickly toggle the publication status, promotion and stickiness of nodes, and the publication status of comments, from links on the page. The module doesn't sufficiently check access to the entity being toggled, under the scenario where a user with the "Use Fasttoggle"...

DRUPAL-CONTRIB-2026-281

The CAPTCHA module places a configurable challenge on forms to block automated submissions. To skip the challenge on later steps of the same multi-step form, the module remembers that a CAPTCHA session has been solved. The module does not fully invalidate a solved CAPTCHA session. As a result, a...

DRUPAL-CONTRIB-2026-278

The Drupal Security Team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, read the documentation on becoming the maintainer of a project that is unsupported for security...

DRUPAL-CONTRIB-2026-277

The Drupal Security Team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, read the documentation on becoming the maintainer of a project that is unsupported for security...

DRUPAL-CONTRIB-2026-276

The Drupal Security Team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, read the documentation on becoming the maintainer of a project that is unsupported for security...

DRUPAL-CONTRIB-2026-275

Single Content Sync enables exporting and importing content, referenced entities, and files between Drupal sites. A maliciously crafted import file can cause untrusted data to be deserialized, potentially leading to remote code execution. This vulnerability is mitigated by the fact that an attack...

DRUPAL-CONTRIB-2026-274

Single Content Sync enables exporting and importing content, referenced entities, and files between Drupal sites. The module does not sufficiently validate file sources and destinations during content imports. An attacker can write arbitrary files, disclose sensitive local files accessible to the...

DRUPAL-CONTRIB-2026-273

The AI module includes a submodule, AI Automator. This submodule allows you to automatically fill out fields using AI, based on other fields. The module doesn't sufficiently check access to text formats, allowing users to author field data in text formats they should not have access to...