Skip to content
OpenAdvisories
Medium WID-SEC-2026-2826 5 CVEs

Drupal Module: Mehrere Schwachstellen

Published Aug 12, 2026 · Updated Sep 2, 2026 · Revision 2 · de-DE

Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um Informationen offenzulegen, Daten zu manipulieren und Sicherheitsmaßnahmen zu umgehen.

Product

Drupal ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Vulnerabilities 5

  • Critical 9.1
    CVE-2026-73475

    Commerce PayPal - Moderately critical - Access bypass - SA-CONTRIB-2026-095

    Incorrect Authorization vulnerability in Drupal Commerce PayPal allows Forceful Browsing. This issue affects Commerce PayPal versions: from 0.0.0 to 1.12.0, from 2.0.0 to 2.1.3.

    Drupal Commerce PayPal drupal/commerce_paypal Packagist
  • Medium 5.4
    CVE-2026-73476

    External Authentication - Moderately critical - Access bypass - SA-CONTRIB-2026-098

    Improper Handling of Case Sensitivity vulnerability in Drupal External Authentication allows Privilege Escalation. This issue affects External Authentication versions: from 0.0.0 to 2.0.13.

    Drupal External Authentication drupal/externalauth Packagist
  • Medium 5.3
    CVE-2026-73474

    Entity Share Websub - Moderately critical - Server-side request forgery (SSRF) - SA-CONTRIB-2026-097

    Server-Side Request Forgery (SSRF) vulnerability in Drupal Entity Share Websub allows Server Side Request Forgery. This issue affects Entity Share Websub versions: from 0.0.0 to 1.1.2.

    Drupal Entity Share Websub drupal/entity_share_websub Packagist
  • Medium 5.3
    CVE-2026-73477

    Quick Tabs - Moderately critical - Access bypass - SA-CONTRIB-2026-099

    Incorrect Authorization vulnerability in Drupal Quick Tabs allows Forceful Browsing. This issue affects Quick Tabs versions: from 0.0.0 to 4.3.1.

    Drupal Quick Tabs drupal/quicktabs Packagist
  • Medium 5.3
    CVE-2026-73478

    Diff - Moderately critical - Access bypass - SA-CONTRIB-2026-096

    Incorrect Authorization vulnerability in Drupal Diff allows Forceful Browsing. This issue affects Diff versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1.

    Drupal Diff drupal/diff Packagist

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-69990, EUVD-2026-69989, EUVD-2026-69993, EUVD-2026-69992, EUVD-2026-69991

  2. #1

    Initiale Fassung

References