Skip to content
OpenAdvisories
Medium WID-SEC-2026-0121 5 CVEs

Drupal Module: Mehrere Schwachstellen

Published Jan 14, 2026 · Updated Feb 4, 2026 · Revision 2 · de-DE

Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Drupal Module ausnutzen, um Sicherheitsvorkehrungen zu umgehen, und um einen Cross-Site Scripting Angriff durchzuführen.

Product

Drupal ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Vulnerabilities 5

  • Medium 6.5
    CVE-2026-0948

    Microsoft Entra ID SSO Login - Critical - Access bypass - SA-CONTRIB-2026-005

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Microsoft Entra ID SSO Login allows Privilege Escalation.This issue affects Microsoft Entra ID SSO Login: from 0.0.0 before 1.0.4.

    Drupal Microsoft Entra ID SSO Login drupal/social_auth_entra_id Packagist
  • Medium 6.1
    CVE-2026-0946

    AT Internet SmartTag - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-003

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AT Internet SmartTag allows Cross-Site Scripting (XSS).This issue affects AT Internet SmartTag: from 0.0.0 before 1.0.1.

    Drupal AT Internet SmartTag drupal/atsmarttag Packagist
  • Medium 5.4
    CVE-2026-0945

    Role Delegation - Moderately critical - Access bypass - SA-CONTRIB-2026-002

    Privilege Defined With Unsafe Actions vulnerability in Drupal Role Delegation allows Privilege Escalation.This issue affects Role Delegation: from 1.3.0 before 1.5.0.

    Drupal Role Delegation drupal/role_delegation Packagist
  • Medium 5.3
    CVE-2026-0944

    Group invite - Moderately critical - Access bypass - SA-CONTRIB-2026-001

    Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Group invite allows Forceful Browsing.This issue affects Group invite: from 0.0.0 before 2.3.9, from 3.0.0 before 3.0.4, from 4.0.0 before 4.0.4.

    Drupal Group invite drupal/ginvite Packagist
  • Medium 4.8
    CVE-2026-0947

    AT Internet Piano Analytics - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-004

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AT Internet Piano Analytics allows Cross-Site Scripting (XSS).This issue affects AT Internet Piano Analytics: from 0.0.0 before 1.0.1, from 2.0.0 befo…

    Drupal AT Internet Piano Analytics drupal/pianoanalytics Packagist

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-5337, EUVD-2026-5338, EUVD-2026-5346, EUVD-2026-5353, EUVD-2026-5354

  2. #1

    Initiale Fassung

References