Skip to content
OpenAdvisories
High WID-SEC-2026-3168 16 CVEs

Drupal Erweiterungen: Mehrere Schwachstellen

Published Sep 2, 2026 · Updated Oct 21, 2026 · Revision 2 · de-DE

Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in verschiedenen Drupal Erweiterungen ausnutzen, um Zugriffsbeschränkungen zu umgehen, geschützte oder sensible Inhalte offenzulegen, Benutzerkonten zu übernehmen, unberechtigte Änderungen oder Löschungen vorzunehmen, Zahlungsstatus zu manipulieren sowie Cross-Site-Scripting-Angriffe auszuführen.

Product

Drupal ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Vulnerabilities 16

  • Medium 6.5
    CVE-2026-84917

    Jsonapi Role Access - Critical - Access bypass - SA-CONTRIB-2026-127

    Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This issue affects Jsonapi Role Access versions: from 0.0.0 to 2.0.2.

    Drupal Jsonapi Role Access drupal/jsonapi_role_access Packagist
  • Medium 6.5
    CVE-2026-84923

    Email Verification / SMS Verification / OTP Verification - Critical - Access Bypass - SA-CONTRIB-2026-124

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Authentication Bypass. This issue affects Email Verification / SMS Verification / OTP Verification versions: from …

    Drupal Email Verification / SMS Verification / OTP Verification drupal/otp_verification Packagist
  • Medium 5.4
    CVE-2026-81163

    Media Library Importer - Moderately critical - Access bypass - SA-CONTRIB-2026-129

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Drupal Media Library Importer allows Path Traversal. This issue affects Media Library Importer versions: from 0.0.0 to 2.1.6.

    Drupal Media Library Importer drupal/media_library_importer Packagist
  • Medium 5.4
    CVE-2026-84924

    Email Verification / SMS Verification / OTP Verification - Critical - Cross Site Scripting - SA-CONTRIB-2026-125

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Reflected XSS. This issue affects Email Verification / SMS Verification / OTP Verifica…

    Drupal Email Verification / SMS Verification / OTP Verification drupal/otp_verification Packagist
  • Medium 5.3
    CVE-2026-84914

    Calculate Working Days - Critical - Access bypass - SA-CONTRIB-2026-122

    Missing Authorization vulnerability in Drupal Calculate Working Days allows Forceful Browsing. This issue affects Calculate Working Days versions: from 0.0.0 to 2.0.3.

    Drupal Calculate Working Days drupal/calculate_working_days Packagist
  • Medium 5.3
    CVE-2026-84920

    Unpublished Node Permissions - Critical - Access bypass - SA-CONTRIB-2026-132

    Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful Browsing. This issue affects Unpublished Node Permissions versions: from 0.0.0 to 1.8.0.

    Drupal Unpublished Node Permissions drupal/unpublished_node_permissions Packagist
  • Medium 5.3
    CVE-2026-84921

    Webform Submissions Delete - Moderately critical - Access bypass - SA-CONTRIB-2026-133

    Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing. This issue affects Webform Submissions Delete versions: from 0.0.0 to 1.2.0.

    Drupal Webform Submissions Delete drupal/webform_submissions_delete Packagist
  • Medium 4.6
    CVE-2026-84912

    AI (Artificial Intelligence) - Moderately critical - Access Bypass - SA-CONTRIB-2026-120

    Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.3.13, from 1.4.0 to 1.4.8.

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • Medium 4.6
    CVE-2026-84913

    AI translate - Moderately critical - Access Bypass - SA-CONTRIB-2026-121

    Missing Authorization vulnerability in Drupal AI Translate allows Forceful Browsing. This issue affects AI Translate versions: from 0.0.0 to 1.3.2, from 1.4.0 to 1.4.1.

    Drupal AI Translate drupal/ai_translate Packagist
  • Medium 4.6
    CVE-2026-84915

    Component blocks - Moderately critical - Cross site scripting - SA-CONTRIB-2026-123

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Component blocks allows Stored XSS. This issue affects Component blocks versions: from 0.0.0 to 1.2.7.

    Drupal Component blocks drupal/component_blocks Packagist
  • Medium 4.6
    CVE-2026-84919

    PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-131

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Stored XSS. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery ve…

    Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery drupal/photoswipe Packagist
  • Medium 4.2
    CVE-2026-84910

    Advanced Search - Moderately critical - Access bypass - SA-CONTRIB-2026-118

    Missing Authorization vulnerability in Drupal Advanced Search allows Forceful Browsing. This issue affects Advanced Search versions: from 0.0.0 to 2.4.5.

    Drupal Advanced Search drupal/advanced_search Packagist
  • Low 3.8
    CVE-2026-16648

    Mailer Plus Log - Moderately critical - Access bypass - SA-CONTRIB-2026-128

    Insertion of Sensitive Information into Log File vulnerability in Drupal Mailer Plus Log allows Remote Services with Stolen Credentials. This issue affects Mailer Plus Log versions: from 0.0.0 to 1.2.7.

    Drupal Mailer Plus Log drupal/symfony_mailer_log Packagist
  • Low 3.7
    CVE-2026-84916

    Islandora - Moderately critical - Access bypass - SA-CONTRIB-2026-126

    Missing Authorization vulnerability in Drupal Islandora allows Forceful Browsing. This issue affects Islandora versions: from 0.0.0 to 2.19.0.

    Drupal Islandora drupal/islandora Packagist
  • Low 3.7
    CVE-2026-84918

    Monobank payment API - Moderately critical - Access bypass - SA-CONTRIB-2026-130

    Improper Verification of Cryptographic Signature vulnerability in Drupal Monobank payment API allows Signature Spoof. This issue affects Monobank payment API versions: from 0.0.0 to 1.0.3.

    Drupal Monobank payment API drupal/monobank Packagist
  • Low 3.1
    CVE-2026-84911

    AI (Artificial Intelligence) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-119

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.3.13, from 1.4.0 to 1.4.8.

    Drupal AI (Artificial Intelligence) drupal/ai Packagist

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-107881, EUVD-2026-107880, EUVD-2026-107878, EUVD-2026-107879, EUVD-2026-107877, EUVD-2026-107876, EUVD-2026-107875, EUVD-2026-107872, EUVD-2026-107873, EUVD-2026-107871, EUVD-2026-107870, EUVD-2026-107869, EUVD-2026-107867, EUVD-2026-107868, EUVD-2026-107866, EUVD-2026-107874

  2. #1

    Initiale Fassung

References