Drupal Aid

Five security advisories came out for Drupal contributed modules today. All five are rated moderately critical, and there was no core release this week.

Quick Tabs (4.3.1) is the one worth checking first, since it turns up on a lot of sites. When it rendered node and block tabs it treated a neutral access result as permission granted, and it skipped the access check on reusable custom blocks entirely. In practice that meant unpublished content could appear to visitors who had no right to see it. What limits the damage is that someone with the "administer quicktabs" permission picks the content when the tab is set up, so an attacker cannot choose what gets exposed.

Commerce PayPal (2.1.3) did not properly validate the transaction result in some cases, which allowed a malicious user to mark an order as paid when no payment had gone through. This only affects sites on the Payflow Link gateway. If you take money through that gateway, move this one to the top of your list.

External Authentication (2.0.13) stores and looks up the mapping between a Drupal account and an external identity provider. Under certain MySQL and MariaDB collation settings it did not match those external identity values exactly, so a login could resolve to the wrong account.

Entity Share Websub (1.1.2) shares content between sites in a hub and subscriber setup. Some of its inputs went unvalidated, which opened it to server-side request forgery.

Diff (2.1.1) did not restrict access to revision comparisons on non-node entities. An attacker needs a role with permission to view the entity in the first place, so the reach here is narrow.

If you don't run any of these five modules, there is nothing for you to do this week. If you do, the fixed releases are listed above and the full advisories are on drupal.org.

Short to-do list out of Drupal today, assuming any of this applies to you.

Update Token Content Access to 3.1.2. The module protects content behind access tokens, and the way it checked those tokens gave away timing information. A determined attacker could measure the response times, narrow down a working token from that, and reach content meant to stay private. Knowing the URL is a prerequisite, so it isn't trivial to pull off, but the fix is available and easy to take.

Uninstall Disable Login Page. Uninstall Powerful Surveys. Both were marked unsupported today, which is the security team's way of saying there is a real problem in the code, the maintainer has gone quiet, and no patch is coming. Both are rated critical. Leaving them installed means running known-broken code with no end date on it. If either does something you rely on, start looking for a replacement now. Anyone willing to take over maintaining them can, and the advisories explain how.

Not running any of them? Then there is nothing here for you to do.

If you look after a Drupal site, today's a good day to check your updates page.

Ten security advisories went out. Most are moderately critical and only matter if you've got the module installed, but two are worth doing sooner rather than later.

Internationalization Single Sign-On has a critical access bypass. On multilingual sites with a domain per language it could let someone see areas they shouldn't. Version 1.8.0 fixes it.

Core has a cross-site scripting hole in Layout Builder, where block labels weren't properly sanitised. Depending on your version you want 10.6.13, 11.3.14 or 11.4.4.

Then update these if you use them:

PhotoSwipe to 3.0.4
UI Patterns to 2.0.17
Media Folders to 1.0.8
Webform REST to 4.1.0
Search API Autocomplete to 1.12.0
AI SEO/GEO Analyzer to 1.1.3
ECA to 3.1.4 or 2.1.20

QA Accounts is a different case. It's lost its security advisory coverage, so no more security fixes will be issued for it. It logs you in with well known credentials and doesn't belong on a production site, so remove it rather than waiting for a patch.

None of this affects modules you don't have installed.

Drupal released a core security update today (SA-CORE-2026-010, 011 & 012).

Because this is Drupal core — not an add-on module — EVERY Drupal 10 and 11 site is affected.

The issue: cross-site scripting (XSS) and information-disclosure vulnerabilities that could let an attacker run malicious code in visitors' browsers or expose data.

What to do:
- Drupal 10 sites: update core to 10.6.13
- Drupal 11 sites: update core to 11.4.4
- Rated "Moderately Critical" by the Drupal Security Team

Security update for Drupal sites.

Salesforce Suite (salesforce) needs to be updated to version 5.1.3.

The issue: Without the update, someone could potentially trick an admin into performing unwanted actions.

This applies to Drupal 10/11 sites.

Geolocation Field (geolocation) needs to be updated to version 3.15.0.

The issue: Without the update, someone could potentially access or modify your database without permission.

This applies to Drupal 10/11 sites.

Paragraphs (paragraphs) needs to be updated to version 1.21.0.

The issue: Without the update, someone could potentially access parts of your site they shouldn't be able to see.

This applies to Drupal 10/11 sites.

This only affects sites using this specific module. If you're not sure whether your site uses it, we can help you check.

Security update for Drupal sites.

Drupal core (core) needs to be updated to version 10.5.12 and 10.6.11 and 11.2.14 and 11.3.12.

The issue: Without the update, someone could potentially compromise your site's security.

This applies to ALL Drupal 10/11 sites.

Security update for Drupal sites.

Examples for Developers (examples) needs to be updated to version 4.0.6.

The issue: Without the update, someone could potentially access parts of your site they shouldn't be able to see.

This applies to Drupal 10/11 sites.

Tagify (tagify) needs to be updated to version 1.2.52.

The issue: Without the update, someone could potentially inject malicious code that runs in visitors' browsers.

This applies to Drupal 10/11 sites.

This only affects sites using this specific module. If you're not sure whether your site uses it, we can help you check.

Drupal released a security update today.

Anti-Spam by CleanTalk (cleantalk) has a security issue that could let someone compromise your site's security.

If you have this module on your site:
- Versions below 9.7.1 are affected
- Update to version 9.7.1
- This applies to Drupal 9 sites

Commerce Core (core) has a security issue that could let someone compromise your site's security.

If you have this module on your site:
- Versions below 3.3.6 are affected
- Update to version 3.3.6
- This applies to Drupal 10/11 sites

TacJS (tacjs) has a security issue that could let someone compromise your site's security.

If you have this module on your site:
- Versions below 6.8.0 are affected
- Update to version 6.8.0
- This applies to Drupal 10/11 sites

If you don't have this module installed, no action needed.