Most recent entries from all

DRUPAL-CONTRIB-2026-238

Affected: Packagist:https://packages.drupal.org/8: drupal/domain

This module enables you to share users, content and configuration across a group of domains from a single Drupal installation. Its Domain Access submodule controls which domains a user may edit content on, and has an optional setting to grant user access per content type.

The module doesn't sufficiently check which domains a user is assigned to when the per-content-type grant setting is enabled.

This vulnerability is mitigated by the fact that the per-content-type grants setting must be enabled (it is off by default), and an attacker must have a role with the permission "Edit any content on assigned domains" or "Delete any content on assigned domains" together with a per-content-type permission such as "Article: Edit any content on assigned domains", and must be assigned to at least one domain.

fkie_cve-2026-114540

Incorrect Authorization vulnerability in Drupal Domain allows Forceful Browsing. This issue affects Domain versions: from 3.0.0 to 3.0.2.

GHSA-jmh3-x5wr-535j

Incorrect Authorization vulnerability in Drupal Domain allows Forceful Browsing. This issue affects Domain versions: from 3.0.0 to 3.0.2.

WID-SEC-W-2026-4230 — Drupal Erweiterungen: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um erweiterte Berechtigungen zu erlangen und Benutzerkonten zu übernehmen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren, Cross-Site-Scripting-Angriffe durchzuführen und nicht näher spezifizierte Auswirkungen zu verursachen.