Most recent entries from all

DRUPAL-CONTRIB-2026-281

2026-10-31T11:46:34.807475+00:00

Affected: Packagist:https://packages.drupal.org/8: drupal/captcha

The CAPTCHA module places a configurable challenge on forms to block automated submissions. To skip the challenge on later steps of the same multi-step form, the module remembers that a CAPTCHA session has been solved.

The module does not fully invalidate a solved CAPTCHA session. As a result, a protected form that was already submitted once can be submitted again without solving a new CAPTCHA. This weakens the protection the module provides against automated submissions such as spam registrations, comment spam, and login brute-forcing.

This is a follow-up to the earlier CAPTCHA replay fix ([SA-CONTRIB-2026-015](https://www.drupal.org/sa-contrib-2026-015) / CVE-2026-3214), which closed one replay path but left this one open.

fkie_cve-2026-118582

2026-10-31T11:46:34.807548+00:00

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality Bypass. This issue affects CAPTCHA versions: from 0.0.0 to 1.18.0, from 2.0.0 to 2.0.11.

GHSA-f93j-m756-g37x

2026-10-31T11:46:34.807577+00:00

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality Bypass. This issue affects CAPTCHA versions: from 0.0.0 to 1.18.0, from 2.0.0 to 2.0.11.

WID-SEC-W-2026-4230 — Drupal Erweiterungen: Mehrere Schwachstellen

2026-10-31T11:46:34.807592+00:00

Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um erweiterte Berechtigungen zu erlangen und Benutzerkonten zu übernehmen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren, Cross-Site-Scripting-Angriffe durchzuführen und nicht näher spezifizierte Auswirkungen zu verursachen.