Drupal Security Updates Require OAuth Reviews, Webhook Changes and Symfony Checks

The Drupal Security Team published 23 new contributed-project security advisories across 21 projects on 4 November 2026. Eight were rated Critical, 14 Moderately critical and one Less critical. The disclosures address authentication, payment notifications, imported content and access controls. Separately, Symfony released security fixes affecting component families used by Drupal.

Several Drupal advisories require more than installing a new module version. Administrators must review existing OAuth consumers, register a replacement payment webhook URL or adjust text-filter configuration, depending on the affected project. The severity ratings describe potential consequences under specific conditions; they do not mean every Drupal installation is exposed. The Security Team also updated an earlier GroupEx PRO advisory after a fix became available.

A Critical advisory for Simple OAuth (OAuth2) & OpenID Connect, SA-CONTRIB-2026-296, describes insufficient restrictions on consumer configuration. Users holding the Add consumer entities or Update own consumer entities permissions could configure malicious consumers and obtain tokens with privileges beyond their intended access. The consequences can include impersonating another user or gaining administrative access. Fixes are available in versions 5.2.6, 6.0.10 and 6.1.4.

The update introduces a separate Administer consumer access settings permission, which should be reserved for trusted roles. On the 6.1.x branch, Client Credentials tokens are now restricted to their scopes, but existing consumers are not automatically changed. The advisory instructs administrators to review those consumers and revoke tokens where there is doubt about their security. Updating alone therefore does not complete this remediation.

Another Critical access-bypass advisory affects REST & JSON API Authentication for Drupal. When API authentication is enabled without a generated application API key, unauthenticated requests may reach resources that should require authentication. Version 3.2.1 addresses the issue. For sites unable to update immediately, the advisory recommends ensuring an API key is generated and auditing logs for suspicious administrative access. The vulnerable condition is not simply the presence of an API endpoint.

Payment integrations carry distinct risks. Commerce Escrow inadequately verified incoming Escrow.com notifications, potentially allowing forged updates that mark orders paid or completed or cancel orders in progress. Its fix is version 1.1.0, after which operators must register the new webhook URL with Escrow.com. Separately, AlternativeCommerce PayPal Checkout could accept crafted webhook requests that mark orders paid without payment. Its corrective version is 1.1.1; the Escrow-specific webhook registration instruction does not apply to this module.

Content Synchronizer has a Critical PHP object injection flaw in the processing of imported archives. A malicious import could cause remote code execution, with exploitation requiring administrative import access. Version 4.1.1 fixes the flaw and also addresses a separate DOM-based cross-site scripting advisory. An earlier GroupEx PRO advisory also concerns PHP object injection with possible code execution. The project was marked unsupported on 28 October but was restored on 4 November following the release of version 2.2.1. This is an update to a previously disclosed advisory, not an additional new advisory in the 4 November batch.

Other disclosures concern the Highlight Js syntax highlighter preview endpoint, unauthorised changes to Workflow Notifications settings, and Commerce Product Alternative, whose flaw affects anonymous visitors' carts rather than authenticated users' carts. Scheduler could allow users with content-editing access to change publication dates through a web services API. WordsOnline Connector has an SQL injection flaw requiring the Create translation jobs permission. These differences matter when determining which projects are installed and whether their documented exposure conditions exist.

The htmLawed advisory SA-CONTRIB-2026-315 adds another configuration task. On affected 4.1.x installations, administrators should update to 4.1.11 and ensure the filter's deny_attribute configuration includes data-hx-*. This issue concerns Drupal versions later than 11.2 or sites using HTMX. The 8.x-3.x branch is not affected by this particular vulnerability. A separate htmLawed advisory concerns malformed UTF-8 input and applies only where SQLite and an htmLawed PHP library older than 1.2.17 are used. The recommended updates are 4.1.11 and 8.x-3.10 for the applicable branches.

Symfony's 4 November release of version 7.4.23 includes separate upstream security fixes. Symfony also lists corrected versions 5.4.56, 6.4.50 and 8.1.11 for affected component branches. Drupal 11.4.11's published core-recommended dependency manifest requires Symfony HTTP Foundation, Routing and Serializer within the 7.4 series. Its version constraints permit older releases as well as the newly fixed 7.4.23, so individual projects must check their installed dependencies rather than infer package versions from the Drupal release number.

Among Symfony's security disclosures, CVE-2026-118514 concerns HEAD requests bypassing GET-only method restrictions in Symfony request matchers. CVE-2026-118515 concerns deserialisation of untrusted data into uploaded-file objects referencing server files. CVE-2026-118516 concerns host placeholders bypassing path rules in compiled URL matchers. Each requires particular application code or configuration. Symfony's release contains further security corrections beyond these three vulnerabilities.

A source-code review of Drupal 11.4.11's URL matcher and serialization service definitions did not establish these specific attack paths in the reviewed standard Drupal code. This is not proof that custom modules or integrations are unaffected, and no runtime exploitation tests were performed. Symfony also states that applications using its vulnerable compiled route matcher must clear the compiled route cache after applying the fix.

For affected installations, the following table summarises the main Drupal release and follow-up requirements:

*The 8.x-3.10 recommendation applies to the separate SQLite-dependent htmLawed advisory, not to SA-CONTRIB-2026-315.

Administrators can compare installed projects with the full advisory index, examine Composer lockfiles and run composer audit as part of their dependency review. Remediation should follow the supported Drupal dependency and module update processes, with backups and testing before production deployment. Arbitrary overrides of Symfony packages do not substitute for checking compatibility and deployed code paths.

The disclosures follow earlier Drupal Commerce security reporting on 29 October, which documented confirmed active exploitation of a different Commerce Core vulnerability, SA-CONTRIB-2026-254. That exploitation claim must not be transferred to the 4 November advisories or Symfony fixes. For the new disclosures, affected versions, permissions and configuration determine which checks administrators need to perform.