Skip to content
OpenAdvisories
Medium WID-SEC-2026-0599 8 CVEs

Drupal Extensions: Mehrere Schwachstellen

Published Mar 4, 2026 · Updated Mar 26, 2026 · Revision 2 · de-DE

Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in verschiedenen Drupal-Erweiterungen ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren oder vertrauliche Informationen offenzulegen.

Product

Drupal ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Vulnerabilities 8

  • Medium 6.5
    CVE-2026-3527

    AJAX Dashboard - Critical - Access bypass - SA-CONTRIB-2026-022

    Missing Authentication for Critical Function vulnerability in Drupal AJAX Dashboard allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AJAX Dashboard: from 0.0.0 before 3.1.0.

    Drupal AJAX Dashboard drupal/ajax_dashboard Packagist
  • Medium 6.5
    CVE-2026-3531

    OpenID Connect / OAuth client - Moderately critical - Access bypass - SA-CONTRIB-2026-026

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect / OAuth client allows Authentication Bypass.This issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0.

    Drupal OpenID Connect / OAuth client drupal/openid_connect Packagist
  • Medium 6.1
    CVE-2026-3528

    Calculation Fields - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-023

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Calculation Fields allows Cross-Site Scripting (XSS).This issue affects Calculation Fields: from 0.0.0 before 1.0.4.

    Drupal Calculation Fields drupal/calculation_fields Packagist
  • Medium 6.1
    CVE-2026-3529

    Google Analytics GA4 - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-024

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Google Analytics GA4 allows Cross-Site Scripting (XSS).This issue affects Google Analytics GA4: from 0.0.0 before 1.1.14.

    Drupal Google Analytics GA4 drupal/ga4_google_analytics Packagist
  • Medium 5.3
    CVE-2026-3525

    File Access Fix (deprecated) - Moderately critical - Access bypass - SA-CONTRIB-2026-020

    Incorrect Authorization vulnerability in Drupal File Access Fix (deprecated) allows Forceful Browsing.This issue affects File Access Fix (deprecated): from 0.0.0 before 1.2.0.

    Drupal File Access Fix (deprecated) drupal/file_access_fix Packagist
  • Medium 5.3
    CVE-2026-3526

    File Access Fix (deprecated) - Moderately critical - Access bypass - SA-CONTRIB-2026-021

    Incorrect Authorization vulnerability in Drupal File Access Fix (deprecated) allows Forceful Browsing.This issue affects File Access Fix (deprecated): from 0.0.0 before 1.2.0.

    Drupal File Access Fix (deprecated) drupal/file_access_fix Packagist
  • Medium 4.3
    CVE-2026-3530

    OpenID Connect / OAuth client - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-025

    Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenID Connect / OAuth client allows Server Side Request Forgery.This issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0.

    Drupal OpenID Connect / OAuth client drupal/openid_connect Packagist
  • Medium 4.2
    CVE-2026-3532

    OpenID Connect / OAuth client - Less critical - Access bypass - SA-CONTRIB-2026-027

    Improper Handling of Case Sensitivity vulnerability in Drupal OpenID Connect / OAuth client allows Privilege Escalation.This issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0.

    Drupal OpenID Connect / OAuth client drupal/openid_connect Packagist

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-16389, EUVD-2026-16379, EUVD-2026-16383, EUVD-2026-16377, EUVD-2026-16385, EUVD-2026-16375, EUVD-2026-16387, EUVD-2026-16381

  2. #1

    Initiale Fassung

References