Vulnerability-Lookup

WID-SEC-W-2026-1882

Vulnerability from csaf_certbund - Published: 2026-06-10 22:00 - Updated: 2026-06-10 22:00

Summary

Drupal: Mehrere Schwachstellen

Severity

Mittel

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Drupal ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Angriff: Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um einen Cross Site Scripting Angriff durchzuführen, Sicherheitsmaßnahmen zu umgehen und weitere, nicht spezifizierte Auswirkungen zu verursachen.

Betroffene Betriebssysteme: - Sonstiges - UNIX - Windows

CVE-2026-11908

Affected products

Known affected 5 products

Product	Identifier	Version
Open Source Drupal Mother May I Open Source / Drupal	`cpe:/a:drupal:drupal:mother_may_i`	Mother May I
Open Source Drupal Examples for Developers <4.0.6 Open Source / Drupal		Examples for Developers <4.0.6
Open Source Drupal Tagify <1.2.52 Open Source / Drupal		Tagify <1.2.52
Open Source Drupal Brute force attack protection Open Source / Drupal	`cpe:/a:drupal:drupal:brute_force_attack_protection`	Brute force attack protection
Open Source Drupal Composer Open Source / Drupal	`cpe:/a:drupal:drupal:composer`	Composer

CVE-2026-11909

Affected products

Known affected 5 products

Product	Identifier	Version
Open Source Drupal Mother May I Open Source / Drupal	`cpe:/a:drupal:drupal:mother_may_i`	Mother May I
Open Source Drupal Examples for Developers <4.0.6 Open Source / Drupal		Examples for Developers <4.0.6
Open Source Drupal Tagify <1.2.52 Open Source / Drupal		Tagify <1.2.52
Open Source Drupal Brute force attack protection Open Source / Drupal	`cpe:/a:drupal:drupal:brute_force_attack_protection`	Brute force attack protection
Open Source Drupal Composer Open Source / Drupal	`cpe:/a:drupal:drupal:composer`	Composer

CVE-2026-11913

Affected products

Known affected 5 products

Product	Identifier	Version
Open Source Drupal Mother May I Open Source / Drupal	`cpe:/a:drupal:drupal:mother_may_i`	Mother May I
Open Source Drupal Examples for Developers <4.0.6 Open Source / Drupal		Examples for Developers <4.0.6
Open Source Drupal Tagify <1.2.52 Open Source / Drupal		Tagify <1.2.52
Open Source Drupal Brute force attack protection Open Source / Drupal	`cpe:/a:drupal:drupal:brute_force_attack_protection`	Brute force attack protection
Open Source Drupal Composer Open Source / Drupal	`cpe:/a:drupal:drupal:composer`	Composer

CVE-2026-11914

Affected products

Known affected 5 products

Product	Identifier	Version
Open Source Drupal Mother May I Open Source / Drupal	`cpe:/a:drupal:drupal:mother_may_i`	Mother May I
Open Source Drupal Examples for Developers <4.0.6 Open Source / Drupal		Examples for Developers <4.0.6
Open Source Drupal Tagify <1.2.52 Open Source / Drupal		Tagify <1.2.52
Open Source Drupal Brute force attack protection Open Source / Drupal	`cpe:/a:drupal:drupal:brute_force_attack_protection`	Brute force attack protection
Open Source Drupal Composer Open Source / Drupal	`cpe:/a:drupal:drupal:composer`	Composer

CVE-2026-11915

Affected products

Known affected 5 products

Product	Identifier	Version
Open Source Drupal Mother May I Open Source / Drupal	`cpe:/a:drupal:drupal:mother_may_i`	Mother May I
Open Source Drupal Examples for Developers <4.0.6 Open Source / Drupal		Examples for Developers <4.0.6
Open Source Drupal Tagify <1.2.52 Open Source / Drupal		Tagify <1.2.52
Open Source Drupal Brute force attack protection Open Source / Drupal	`cpe:/a:drupal:drupal:brute_force_attack_protection`	Brute force attack protection
Open Source Drupal Composer Open Source / Drupal	`cpe:/a:drupal:drupal:composer`	Composer

References

7 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://www.drupal.org/sa-contrib-2026-043	external
https://www.drupal.org/sa-contrib-2026-044	external
https://www.drupal.org/sa-contrib-2026-045	external
https://www.drupal.org/sa-contrib-2026-046	external
https://www.drupal.org/sa-contrib-2026-047	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Drupal ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. \u00dcber zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um einen Cross Site Scripting Angriff durchzuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen und weitere, nicht spezifizierte Auswirkungen zu verursachen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-1882 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1882.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-1882 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1882"
      },
      {
        "category": "external",
        "summary": "Drupal Security Advisory sa-contrib-2026-043 vom 2026-06-10",
        "url": "https://www.drupal.org/sa-contrib-2026-043"
      },
      {
        "category": "external",
        "summary": "Drupal Security Advisory sa-contrib-2026-044 vom 2026-06-10",
        "url": "https://www.drupal.org/sa-contrib-2026-044"
      },
      {
        "category": "external",
        "summary": "Drupal Security Advisory sa-contrib-2026-045 vom 2026-06-10",
        "url": "https://www.drupal.org/sa-contrib-2026-045"
      },
      {
        "category": "external",
        "summary": "Drupal Security Advisory sa-contrib-2026-046 vom 2026-06-10",
        "url": "https://www.drupal.org/sa-contrib-2026-046"
      },
      {
        "category": "external",
        "summary": "Drupal Security Advisory sa-contrib-2026-047 vom 2026-06-10",
        "url": "https://www.drupal.org/sa-contrib-2026-047"
      }
    ],
    "source_lang": "en-US",
    "title": "Drupal: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-06-10T22:00:00.000+00:00",
      "generator": {
        "date": "2026-06-11T10:55:54.135+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-1882",
      "initial_release_date": "2026-06-10T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-06-10T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "Tagify \u003c1.2.52",
                "product": {
                  "name": "Open Source Drupal Tagify \u003c1.2.52",
                  "product_id": "T055254"
                }
              },
              {
                "category": "product_version",
                "name": "Tagify 1.2.52",
                "product": {
                  "name": "Open Source Drupal Tagify 1.2.52",
                  "product_id": "T055254-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:drupal:drupal:tagify__1.2.52"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Examples for Developers \u003c4.0.6",
                "product": {
                  "name": "Open Source Drupal Examples for Developers \u003c4.0.6",
                  "product_id": "T055255"
                }
              },
              {
                "category": "product_version",
                "name": "Examples for Developers 4.0.6",
                "product": {
                  "name": "Open Source Drupal Examples for Developers 4.0.6",
                  "product_id": "T055255-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:drupal:drupal:examples_for_developers__4.0.6"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "Mother May I",
                "product": {
                  "name": "Open Source Drupal Mother May I",
                  "product_id": "T055256",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:drupal:drupal:mother_may_i"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "Composer",
                "product": {
                  "name": "Open Source Drupal Composer",
                  "product_id": "T055257",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:drupal:drupal:composer"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "Brute force attack protection",
                "product": {
                  "name": "Open Source Drupal Brute force attack protection",
                  "product_id": "T055258",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:drupal:drupal:brute_force_attack_protection"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Drupal"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-11908",
      "product_status": {
        "known_affected": [
          "T055256",
          "T055255",
          "T055254",
          "T055258",
          "T055257"
        ]
      },
      "release_date": "2026-06-10T22:00:00.000+00:00",
      "title": "CVE-2026-11908"
    },
    {
      "cve": "CVE-2026-11909",
      "product_status": {
        "known_affected": [
          "T055256",
          "T055255",
          "T055254",
          "T055258",
          "T055257"
        ]
      },
      "release_date": "2026-06-10T22:00:00.000+00:00",
      "title": "CVE-2026-11909"
    },
    {
      "cve": "CVE-2026-11913",
      "product_status": {
        "known_affected": [
          "T055256",
          "T055255",
          "T055254",
          "T055258",
          "T055257"
        ]
      },
      "release_date": "2026-06-10T22:00:00.000+00:00",
      "title": "CVE-2026-11913"
    },
    {
      "cve": "CVE-2026-11914",
      "product_status": {
        "known_affected": [
          "T055256",
          "T055255",
          "T055254",
          "T055258",
          "T055257"
        ]
      },
      "release_date": "2026-06-10T22:00:00.000+00:00",
      "title": "CVE-2026-11914"
    },
    {
      "cve": "CVE-2026-11915",
      "product_status": {
        "known_affected": [
          "T055256",
          "T055255",
          "T055254",
          "T055258",
          "T055257"
        ]
      },
      "release_date": "2026-06-10T22:00:00.000+00:00",
      "title": "CVE-2026-11915"
    }
  ]
}

CVE-2026-11908 (GCVE-0-2026-11908)

Vulnerability from cvelistv5 – Published: 2026-07-10 21:43 – Updated: 2026-07-10 21:43

Title

Tagify - Moderately critical - Cross-site scripting (XSS) - SA-CONTRIB-2026-043

Summary

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Tagify allows Stored XSS. This issue affects Tagify versions: from 0.0.0 to 1.2.52.

Severity

No CVSS data available.

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")

Assigner

drupal

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-043

Impacted products

1 product

Vendor	Product	Version
Drupal	Tagify	Affected: 0.0.0 , < 1.2.52 (semver)

Date Public

2026-06-10 17:07

Credits

Pierre Rudloff (prudloff) David Galeano (gxleano) Greg Knaddison (greggles) Dave Long (longwave) Pierre Rudloff (prudloff)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/tagify",
          "product": "Tagify",
          "repo": "https://git.drupalcode.org/project/tagify",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "1.2.52",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Pierre Rudloff (prudloff)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "David Galeano (gxleano)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Dave Long (longwave)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Pierre Rudloff (prudloff)"
        }
      ],
      "datePublic": "2026-06-10T17:07:12.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Tagify allows Stored XSS. This issue affects Tagify versions: from 0.0.0 to 1.2.52."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-592",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-592 Stored XSS"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\")",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-10T21:43:03.734Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-043"
        }
      ],
      "title": "Tagify - Moderately critical - Cross-site scripting (XSS) - SA-CONTRIB-2026-043"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-11908",
    "datePublished": "2026-07-10T21:43:03.734Z",
    "dateReserved": "2026-06-10T16:26:54.582Z",
    "dateUpdated": "2026-07-10T21:43:03.734Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-11909 (GCVE-0-2026-11909)

Vulnerability from cvelistv5 – Published: 2026-07-10 21:43 – Updated: 2026-07-10 21:43

Title

Examples for Developers - Moderately critical - Access bypass - SA-CONTRIB-2026-044

Summary

Missing Authorization vulnerability in Drupal Examples for Developers allows Forceful Browsing. This issue affects Examples for Developers versions: from 0.0.0 to 4.0.6.

Severity

No CVSS data available.

CWE

CWE-862 - Missing Authorization

Assigner

drupal

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-044

Impacted products

1 product

Vendor	Product	Version
Drupal	Examples for Developers	Affected: 0.0.0 , < 4.0.6 (semver)

Date Public

2026-06-10 17:07

Credits

Pierre Rudloff (prudloff) Alberto Paderno (avpaderno) Pierre Rudloff (prudloff) Greg Knaddison (greggles) Juraj Nemec (poker10)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/examples",
          "product": "Examples for Developers",
          "repo": "https://git.drupalcode.org/project/examples",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "4.0.6",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Pierre Rudloff (prudloff)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Alberto Paderno (avpaderno)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Pierre Rudloff (prudloff)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        }
      ],
      "datePublic": "2026-06-10T17:07:55.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Missing Authorization vulnerability in Drupal Examples for Developers allows Forceful Browsing. This issue affects Examples for Developers versions: from 0.0.0 to 4.0.6."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-87",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-87 Forceful Browsing"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-10T21:43:38.232Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-044"
        }
      ],
      "title": "Examples for Developers - Moderately critical - Access bypass - SA-CONTRIB-2026-044"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-11909",
    "datePublished": "2026-07-10T21:43:38.232Z",
    "dateReserved": "2026-06-10T16:26:55.928Z",
    "dateUpdated": "2026-07-10T21:43:38.232Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-11913 (GCVE-0-2026-11913)

Vulnerability from cvelistv5 – Published: 2026-07-10 22:00 – Updated: 2026-07-10 22:00

Title

Mother May I - Critical - Unsupported - SA-CONTRIB-2026-045

Summary

vulnerability in Drupal Mother May I allows . This issue affects Mother May I versions: *.*.

Severity

No CVSS data available.

Assigner

drupal

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-045

Impacted products

1 product

Vendor	Product	Version
Drupal	Mother May I	Affected: . (semver)

Date Public

2026-06-10 17:08

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/mothermayi",
          "product": "Mother May I",
          "repo": "https://git.drupalcode.org/project/mothermayi",
          "vendor": "Drupal",
          "versions": [
            {
              "status": "affected",
              "version": "*.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-06-10T17:08:53.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "vulnerability in Drupal Mother May I allows . This issue affects Mother May I versions: *.*."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-10T22:00:08.662Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-045"
        }
      ],
      "title": "Mother May I - Critical - Unsupported - SA-CONTRIB-2026-045"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-11913",
    "datePublished": "2026-07-10T22:00:08.662Z",
    "dateReserved": "2026-06-10T16:43:04.126Z",
    "dateUpdated": "2026-07-10T22:00:08.662Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-11914 (GCVE-0-2026-11914)

Vulnerability from cvelistv5 – Published: 2026-07-10 21:59 – Updated: 2026-07-10 21:59

Title

Composer - Critical - Unsupported - SA-CONTRIB-2026-046

Summary

vulnerability in Drupal Composer allows . This issue affects Composer versions: *.*.

Severity

No CVSS data available.

Assigner

drupal

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-046

Impacted products

1 product

Vendor	Product	Version
Drupal	Composer	Affected: . (semver)

Date Public

2026-06-10 17:09

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/composer",
          "product": "Composer",
          "repo": "https://git.drupalcode.org/project/composer",
          "vendor": "Drupal",
          "versions": [
            {
              "status": "affected",
              "version": "*.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-06-10T17:09:45.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "vulnerability in Drupal Composer allows . This issue affects Composer versions: *.*."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-10T21:59:28.008Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-046"
        }
      ],
      "title": "Composer - Critical - Unsupported - SA-CONTRIB-2026-046"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-11914",
    "datePublished": "2026-07-10T21:59:28.008Z",
    "dateReserved": "2026-06-10T16:43:05.303Z",
    "dateUpdated": "2026-07-10T21:59:28.008Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-11915 (GCVE-0-2026-11915)

Vulnerability from cvelistv5 – Published: 2026-07-10 21:58 – Updated: 2026-07-10 21:58

Title

Brute force attack protection - Critical - Unsupported - SA-CONTRIB-2026-047

Summary

vulnerability in Drupal Brute force attack protection allows . This issue affects Brute force attack protection versions: *.*.

Severity

No CVSS data available.

Assigner

drupal

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-047

Impacted products

1 product

Vendor	Product	Version
Drupal	Brute force attack protection	Affected: . (semver)

Date Public

2026-06-10 17:10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/bfap_sb",
          "product": "Brute force attack protection",
          "repo": "https://git.drupalcode.org/project/bfap_sb",
          "vendor": "Drupal",
          "versions": [
            {
              "status": "affected",
              "version": "*.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-06-10T17:10:26.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "vulnerability in Drupal Brute force attack protection allows . This issue affects Brute force attack protection versions: *.*."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-10T21:58:18.624Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-047"
        }
      ],
      "title": "Brute force attack protection - Critical - Unsupported - SA-CONTRIB-2026-047"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-11915",
    "datePublished": "2026-07-10T21:58:18.624Z",
    "dateReserved": "2026-06-10T16:43:06.497Z",
    "dateUpdated": "2026-07-10T21:58:18.624Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

WID-SEC-W-2026-1882

CVE-2026-11908 (GCVE-0-2026-11908)

CVE-2026-11909 (GCVE-0-2026-11909)

CVE-2026-11913 (GCVE-0-2026-11913)

CVE-2026-11914 (GCVE-0-2026-11914)

CVE-2026-11915 (GCVE-0-2026-11915)

Tags

Sightings

Nomenclature