Drupal Issues 24 Security Advisories Led by Critical GraphQL Account Takeover Flaw

The Drupal Security Team published 24 security advisories affecting 19 contributed projects on 11 November 2026, led by a Critical vulnerability in GraphQL Core Schema that could allow users to take control of other accounts. The disclosures, numbered SA-CONTRIB-2026-316 through SA-CONTRIB-2026-339, comprise one Critical, 22 Moderately critical and one Less critical advisory. The GraphQL flaw could affect administrator accounts when a specific schema extension is enabled.

The batch covers several distinct security failures involving authentication, payment processing, PDF generation, file uploads and content rendering. Some fixes also require administrators to review enabled submodules, permissions or authentication integrations rather than simply update a package. These are contributed-project advisories, not new Drupal core security disclosures. The Security Team classifies exploitation of the reported vulnerabilities as theoretical, and active exploitation of the batch has not been independently verified.

The GraphQL Core Schema vulnerability, tracked as CVE-2026-126725 and rated Critical at 15 out of 25, involves insufficient authorisation when changing user passwords through the GraphQL API. A user with permission to view another account could change that account's password, including an administrator's, without having permission to update the account. A review of the corresponding source-code patch identifies the missing entity-level access check alongside the existing password-field permission check. Version 1.0.29 adds the required authorisation check.

The vulnerability requires the optional User Login schema extension to be enabled on a GraphQL server. Administrators unable to update immediately can disable that extension, although doing so also removes login and password-management mutations that decoupled frontends may use. The advisory does not establish that installations without the extension are exposed to the same flaw.

Three further advisories affect Authenticator Login Plus (2FA). SA-CONTRIB-2026-320 concerns authentication providers that verify credentials on individual requests, potentially allowing an attacker who already knows an account password to use its permissions without completing the second factor. Exploitation requires a per-request provider, such as HTTP Basic Authentication, together with an alternate authentication method such as JSON:API or REST. SA-CONTRIB-2026-321 addresses login-related actions being triggered before second-factor verification, while SA-CONTRIB-2026-322 concerns a timing-dependent flaw in pending-login handling that could lead to account takeover under additional conditions.

All three Authenticator Login Plus issues are addressed in version 1.0.3. The release changes how the module handles login finalisation for one-time login links, single sign-on integrations and custom authentication code. Administrators using these mechanisms should test their login workflows after updating, particularly where additional actions depend on authentication events. The release also requires database updates and cache clearing.

Session security is affected separately in Entity Print, which generates PDF documents from Drupal entities. Its Dompdf integration could send a user's session cookie and configured HTTP authentication credentials to third-party servers when retrieving external images or stylesheets during PDF generation. An attacker who could place such resources in printable content might obtain credentials capable of impersonating the user. The flaw requires permission to create or edit content using a text format that permits external resources. Version 8.x-2.20 restricts credential forwarding, while disabling Dompdf's Enable Remote URLs setting is the documented temporary mitigation.

Two advisories involving Mollie for Drupal address payment-processing integrity and information disclosure. SA-CONTRIB-2026-328 concerns insufficient validation of incoming webhook calls that could allow payments to be applied incorrectly. The 2.3.2 release tightens the association between a payment transaction, its order and the webhook processing context. A separate advisory identifies possible exposure of a secret token when the Mollie Webform submodule is enabled. Both issues are addressed in version 2.3.2, and the disclosures do not establish that every Mollie installation is affected.

Two vulnerabilities in Commerce License also concern transaction and access integrity. SA-CONTRIB-2026-323 allows an attacker to take over another user's license when JSON:API or REST is configured to permit writes to order items, which is not the default configuration. The Less critical SA-CONTRIB-2026-324 could allow a customer to obtain a license without paying its full price when order items can be modified outside the standard cart form. Version 3.1.2 resolves both issues. Separately, Commerce sermepa 8.x-2.5 corrects insufficient verification that a Redsys payment response belongs to the order being processed.

File storage and upload permissions account for another set of disclosures. S3 File System CORS Upload could allow users with access to its upload widget to overwrite other objects stored in an S3 bucket, including files they were not authorised to replace. Version 8.x-1.4 restricts upload authorisation to specific object keys and introduces additional validation. The disclosure follows a separate 4 November advisory affecting the same project that concerned unauthorised file deletion.

The File Resumable Upload module has a different access-control problem. Unauthenticated visitors could initiate uploads through forms they were not permitted to use, leaving partial upload data on the server. The advisory notes that normal entity-form access checks still prevent the data from being attached to content and that the stored partial data is not executable by the web server. Version 2.0.6 fixes the issue.

Other access-control vulnerabilities involve content editing and administrative permissions. Paragraphs Edit could allow authenticated users to target paragraph edit or delete routes without sufficient authorisation when they knew or could guess a paragraph identifier. Version 3.0.2 fixes the issue, while the 4.x branch is unaffected. Download Count allowed users holding only the View download counts permission to export download logs or delete records. Administrators should install version 2.2.5 or 3.0.2, depending on their branch, and review the module's permissions.

Several disclosures concern cross-site scripting and unsafe content rendering. The Texts module insufficiently validated translation HTML, potentially allowing users with translation-editing privileges to introduce executable JavaScript. A second Texts advisory addresses cross-site request forgery involving duplicate-translation restoration. Both vulnerabilities are corrected in Texts 1.0.17, although their affected version ranges differ.

The Paragraphs entity embed module fixes an autocomplete-related cross-site scripting vulnerability in version 4.0.1. Smart Trim addresses insufficient HTML escaping in its Twig filters through versions 2.2.2 and 2.3.2. The Smart Trim issue requires an affected Twig filter to process attacker-controlled content; installations using only the field formatter are not vulnerable to that issue. Data field similarly corrects insufficient escaping of suggestion labels in its Search - autocomplete widget through versions 2.0.15 and 3.0.1. The Data field vulnerability requires the affected widget to be configured and an attacker to have permission to edit an entity carrying the field.

A separate Real Name advisory concerns Twig injection rather than ordinary HTML escaping. The module could evaluate Twig syntax supplied through editable user-profile fields when generating a configured real-name pattern. Exploitation requires a name pattern containing user-controlled data and permission for the attacker to edit that data. Version 2.0.1 sanitises the input and clears stored real names so they can be regenerated.

Two more cross-site scripting advisories affect frontend integrations. Layout Builder iFrame Modal 1.3.9 corrects insufficient sanitisation of Ajax dialog options, with exploitation requiring control of an Ajax response or specific page markup. The fix also depends on Drupal core containing the earlier SA-CORE-2026-001 correction. COOKiES Consent Management 1.2.17 fixes a scripting vulnerability involving the COOKiES Video submodule and specially constructed Blazy iframe markup.

Cross-site request forgery vulnerabilities complete the advisory batch. Page Manager could allow an attacker to trick an administrator into enabling or disabling a page when the Page Manager UI submodule is enabled and the targeted user has the administer pages permission. Version 8.x-4.1 corrects the issue, with database updates or cache clearing required for the change to take effect. Campaign Monitor 3.0.3 addresses a separate cross-site request forgery vulnerability involving its administrative list-management functionality.

Administrators should review the versions and configurations of affected contributed projects against the individual advisories before applying the appropriate fixes. Particular attention is required for GraphQL's User Login extension, alternative authentication methods, Dompdf remote-resource handling, payment integrations and direct-to-S3 upload widgets. Sites using the affected modules should also complete any required database updates, clear caches where specified, review newly introduced permissions and verify dependent Drupal core security corrections.

The full set of disclosures is available through Drupal.org's contributed-project security advisory listing. Each advisory identifies the affected releases, corrected versions and configuration conditions relevant to exploitation. Those distinctions are necessary to assess exposure without assuming that every site using an affected project is vulnerable.