Drupal Erweiterungen: Mehrere Schwachstellen
WID-SEC-2026-3554 · first 24.09.2026 · updated 22.10.2026 · CVSS 9,8
What it is about
Drupal ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden. Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und offenzulegen oder Cross-Site-Scripting-Angriffe durchzuführen.
Under what conditions?
The BSI does not name any particular preconditions. Exploitable remotely according to the BSI.
What can happen in the worst case
An attacker could use the vulnerability to
- beliebigen Programmcode auszuführen
- erweiterte Berechtigungen zu erlangen
- Sicherheitsmaßnahmen zu umgehen
- Daten zu manipulieren
- offenzulegen oder Cross-Site-Scripting-Angriffe durchzuführen
Am I affected?
Affected according to the BSI:
- Open Source Drupal Webform <6.2.12
- Open Source Drupal Webform <6.3.1
- Open Source Drupal Cloud <7.0.1
- Open Source Drupal Project Browser <2.0.3
- Open Source Drupal Project Browser <2.1.5
- Open Source Drupal Commerce Decoupled Checkout <1.8.0
- Open Source Drupal Mermaid Diagram Field <1.0.9
- Open Source Drupal CookieCuttr <2.0.3
- Open Source Drupal REST & JSON API Authentication <3.2.0
- Open Source Drupal Stop administrator login <1.6
- Open Source Drupal Tawk.to-Live chat application <3.0.4
- Open Source Drupal Editoria11y Accessibility Checker <2.2.23
and 7 more
The installed version is usually shown under “Help → About” or in the device’s admin interface.
What helps?
Update to at least:
- Open Source Drupal Webform 6.2.12
- Open Source Drupal Webform 6.3.1
- Open Source Drupal Cloud 7.0.1
- Open Source Drupal Project Browser 2.0.3
- Open Source Drupal Project Browser 2.1.5
- Open Source Drupal Commerce Decoupled Checkout 1.8.0
- Open Source Drupal Mermaid Diagram Field 1.0.9
- Open Source Drupal CookieCuttr 2.0.3
- Open Source Drupal REST & JSON API Authentication 3.2.0
- Open Source Drupal Stop administrator login 1.6
- Open Source Drupal Tawk.to-Live chat application 3.0.4
- Open Source Drupal Editoria11y Accessibility Checker 2.2.23
Is the vulnerability already being exploited?
None of the CVEs is in the CISA catalogue of exploited vulnerabilities. That does not mean there are no attacks, only that none are documented.
Information and sources
- Original BSI advisory (WID)
- Drupal Security Advisory sa-contrib-2026-154 vom 2026-09-23 www.drupal.org
- Drupal Security Advisory sa-contrib-2026-155 vom 2026-09-23 www.drupal.org
- Drupal Security Advisory sa-contrib-2026-158 vom 2026-09-23 www.drupal.org
- Drupal Security Advisory sa-contrib-2026-158 vom 2026-09-23 www.drupal.org
- Drupal Security Advisory sa-contrib-2026-159 vom 2026-09-23 www.drupal.org
- Drupal Security Advisory sa-contrib-2026-160 vom 2026-09-23 www.drupal.org
- Drupal Security Advisory sa-contrib-2026-161 vom 2026-09-23 www.drupal.org
- Drupal Security Advisory sa-contrib-2026-162 vom 2026-09-23 www.drupal.org
- Drupal Security Advisory sa-contrib-2026-163 vom 2026-09-23 www.drupal.org
- Drupal Security Advisory sa-contrib-2026-164 vom 2026-09-23 www.drupal.org
- Drupal Security Advisory sa-contrib-2026-165 vom 2026-09-23 www.drupal.org
- Drupal Security Advisory sa-contrib-2026-166 vom 2026-09-23 www.drupal.org
- Drupal Security Advisory sa-contrib-2026-167 vom 2026-09-23 www.drupal.org
- Drupal Security Advisory sa-contrib-2026-168 vom 2026-09-23 www.drupal.org
- Drupal Security Advisory sa-contrib-2026-169 vom 2026-09-23 www.drupal.org
- Drupal Security Advisory sa-contrib-2026-170 vom 2026-09-23 www.drupal.org
- Drupal Security Advisory sa-contrib-2026-171 vom 2026-09-23 www.drupal.org
- Drupal Security Advisory sa-contrib-2026-172 vom 2026-09-23 www.drupal.org
- Drupal Security Advisory sa-contrib-2026-173 vom 2026-09-23 www.drupal.org
- Drupal Security Advisory sa-contrib-2026-174 vom 2026-09-23 www.drupal.org
- Drupal Security Advisory sa-contrib-2026-175 vom 2026-09-23 www.drupal.org
- Drupal Security Advisory sa-contrib-2026-176 vom 2026-09-23 www.drupal.org
- Drupal Security Advisory sa-contrib-2026-177 vom 2026-09-23 www.drupal.org
- Drupal Security Advisory sa-contrib-2026-178 vom 2026-09-23 www.drupal.org
- Drupal Security Advisory sa-contrib-2026-179 vom 2026-09-23 www.drupal.org
and 12 more sources in the original advisory
CVE: CVE-2026-96355, CVE-2026-96356, CVE-2026-96357, CVE-2026-96358, CVE-2026-96359, CVE-2026-96360, CVE-2026-96361, CVE-2026-96362, CVE-2026-96363, CVE-2026-96364, CVE-2026-96365, CVE-2026-96366, CVE-2026-96367, CVE-2026-96368, CVE-2026-96369, CVE-2026-96370, CVE-2026-96371, CVE-2026-96372, CVE-2026-96373, CVE-2026-96374 …
Source: BSI warning and information service (CERT-Bund); CISA. The assessment of the conditions is my reading of the BSI text; the external pages are in their original language.