CVE-2026-18259
CVE-2026-18259 · Token Content Access - Moderately critical - Access bypass - SA-CONTRIB-2026-090
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. This issue affects Token Content Access versions: from 0.0.0 to 3.1.2.
CVSS 7.5 · High · EPSS 0.4% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
token content access
- Versions
- ≥ 0.0.0, < 3.1.2: Affected (semver)
Update to 3.1.2
drupal/tca Packagist:https://packages.drupal.org/8
- Affected ranges
- ECOSYSTEM: < 3.1.2
Update to 3.1.2