Drupal extensions: several critical flaws allow account takeover
Several weaknesses in add-on modules for the Drupal website software let attackers take control of user accounts, gain higher access rights, or read and change data. Websites using these add-ons could be compromised.
| Severity | CriticalVulnerability |
|---|---|
| Being exploited? | UnclearNo reports either way yet |
| Fix available? | UnclearNo fixed version published in the sources yet |
| How sure is this? | Official sourceBacked by an official source |
What happened
Multiple critical vulnerabilities exist in Drupal extensions (add-on modules), enabling privilege escalation, account takeover, security bypass, information disclosure, data manipulation, and cross-site scripting.
Are you affected?
You are affected if your Drupal website uses vulnerable third-party extensions (add-on modules); the specific modules and versions are not named in this advisory.
Drupal extensions (add-on modules), specific modules and versions unknown
What to do
- Identify all Drupal extensions installed on your website
- Check the official Drupal security advisories and update each affected extension to its latest version
- Review user accounts and permissions for unexpected changes
Timeline
- 29 Oct 2026, 13:59 UTCPublicly disclosed
- 29 Oct 2026, 13:59 UTCReported by CERT-Bund (BSI) · CERT-Bund (BSI)
- 29 Oct 2026, 14:04 UTCPicked up by Zero Radar
Sources 1 report, oldest first
Official vendor, government CERT or advisory database
- [NEU] [kritisch] Drupal Erweiterungen: Mehrere SchwachstellenCERT-Bund (BSI) · 29 Oct 2026, 13:59 UTC
Technical details
- ID
- ZR-9af41563
- Disclosed
- 29 Oct 2026, 13:59 UTC
- On Zero Radar
- 29 Oct 2026, 14:04 UTC (5 min after disclosure)
- Last change
- 29 Oct 2026, 14:04 UTC
The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works