DRUPAL-CONTRIB-2026-238

DRUPAL-CONTRIB-2026-238

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This module enables you to share users, content and configuration across a group of domains from a single Drupal installation. Its Domain Access submodule controls which domains a user may edit content on, and has an optional setting to grant user access per content type. The module doesn't sufficiently check which domains a user is assigned to when the per-content-type grant setting is enabled. This vulnerability is mitigated by the fact that the per-content-type grants setting must be enabled (it is off by default), and an attacker must have a role with the permission "Edit any content on assigned domains" or "Delete any content on assigned domains" together with a per-content-type permission such as "Article: Edit any content on assigned domains", and must be assigned to at least one domain.

Fix available

Published

2026-10-21T17:50:53Z

Updated

2026-10-21T18:15:04.033437691Z

Stack: php

Check your server →