CVE-2026-16648
CVE-2026-16648 · Mailer Plus Log - Moderately critical - Access bypass - SA-CONTRIB-2026-128
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Insertion of Sensitive Information into Log File vulnerability in Drupal Mailer Plus Log allows Remote Services with Stolen Credentials. This issue affects Mailer Plus Log versions: from 0.0.0 to 1.2.7.
CVSS 3.8 · Low · EPSS 0.2% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
mailer plus log
- Versions
- ≥ 0.0.0, < 1.2.7: Affected (semver)
Update to 1.2.7
drupal/symfony_mailer_log Packagist:https://packages.drupal.org/8
- Affected ranges
- ECOSYSTEM: < 1.2.7
Update to 1.2.7