Drupal Security Advisories Require One Update and Two Uninstalls

Site owners using any of three contributed Drupal projects face different security responses after advisories published on 29 July 2026. The Drupal Security Team released a patched version of Token Content Access, but marked Disable Login Page and Powerful Surveys unsupported. The latter two advisories say known security issues remain unfixed.

The distinction is operational: Token Content Access has a supported upgrade path, while the other two projects do not. Sites can update the first module, but should uninstall or replace the unsupported projects. Matching risk scores for the two unsupported projects do not mean they contain the same vulnerability.

Drupal's procedure for marking a project unsupported for security reasons requires a standard Critical score of 16 out of 25 and the vector AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:All, regardless of the issue evaluated in the original report. The procedure explains that an incomplete investigation may leave additional risks undiscovered, making the relatively high score a precautionary estimate. The score therefore represents uncertainty around an unresolved issue. It does not establish that Disable Login Page and Powerful Surveys share an attack path or technical defect.

Token Content Access presents a narrower and better-defined problem. The module protects individual nodes with tokens supplied through their URLs. In affected releases, some token comparisons can expose measurable timing differences. A persistent attacker who knows or discovers a protected URL could potentially measure those differences, guess a valid token, and bypass the content restriction. All releases before 3.1.2 are affected, and sites running Drupal 10.2 or Drupal 11 should update to Token Content Access 3.1.2.

The advisory rates the Token Content Access flaw Moderately Critical at 10 out of 25. Its risk vector indicates that anonymous attackers can attempt exploitation, but the attack is complex, theoretical, and limited to uncommon configurations. The advisory identifies some confidentiality exposure and no corresponding integrity impact. It credits Drupal.org contributor Robin (robincs) with reporting the vulnerability and Kyrylo Loboda with fixing it.

Disable Login Page has relevant security history, but the published record does not connect its earlier flaw to the current unresolved issue. On 3 December 2025, SA-CONTRIB-2025-124 disclosed that users with valid credentials could bypass the module's login-page restrictions through the REST login endpoint or other HTTP authentication routes. That advisory directed sites to upgrade to version 1.1.3. The new unsupported notice uses a different CVE identifier, affects every version, and replaces the previous update path with an instruction to uninstall the module.

Powerful Surveys has no technical vulnerability description in the current advisory. Its project page describes it as a survey-building distribution, and its release page lists version 1.0.1 as insecure and unsupported. The advisory affects every version and provides neither a patched release nor a configuration-level mitigation. The underlying security issue remains undisclosed.

The two removals continue a wider run of unsupported-project advisories during July 2026. Clean RESTful was marked unsupported on 8 July, followed on 22 July by PanKM, Commerce Elavon, Email Login OTP, Lunr exposed filters, and Development Environment. Those notices use the same standard risk vector and uninstall instruction. The pattern reflects support failures across unrelated projects, not a demonstrated common vulnerability family.

Drupal's security advisory policy states that project usage is not considered when determining whether an eligible project receives an advisory. Site owners should therefore base their response on whether the dependency is present and whether a supported release exists, rather than assumptions about its popularity. Sites using drupal/tca should deploy version 3.1.2. Sites using Disable Login Page or Powerful Surveys should uninstall the projects and identify maintained alternatives because neither currently offers a supported release.