[NEW] [medium] Drupal (Token Content Access, Disable Login Page and Powerful Surveys): Multiple vulnerabilities
An attacker can exploit multiple vulnerabilities in Drupal (Token Content Access, Disable Login Page and Powerful Surveys) to bypass security measures and cause unspecified impacts.
CSIRTS triage
- What
- Multiple vulnerabilities allow an attacker to bypass security measures and cause unspecified impacts.
- Who is affected
- Deployments of Drupal with Token Content Access, Disable Login Page, and Powerful Surveys are affected.
- Urgency
- Remediation is medium priority as the vulnerabilities could lead to security breaches.
- Action
- Update the affected Drupal modules to their latest versions.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Drupal
Get an email when a new Drupal advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2587
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-18259 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-18260 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-18261 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- mediumCVE-2026-18261: Vulnerability in Drupal Powerful Surveys. This issue affects Powerful Surveys versions: *.*.nvd
- mediumCVE-2026-18260: Vulnerability in Drupal Disable Login Page. This issue affects Disable Login Page versions: *.…nvd
- highCVE-2026-18259: Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force.…nvd
Recent advisories for Drupal
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- high[NEW] [high] Drupal Extensions: Multiple Vulnerabilitiescert-bund · 2026-09-03
- high[NEW] [high] Drupal Extensions: Multiple vulnerabilitiescert-bund · 2026-09-03
- high[NEW] [UNPATCHED] [high] Drupal Module: Multiple vulnerabilities enable unspecified attackcert-bund · 2026-09-03
- medium[NEW] [medium] Drupal Module: Multiple vulnerabilitiescert-bund · 2026-09-03
- medium[NEW] [medium] Drupal Module: Multiple Vulnerabilitiescert-bund · 2026-09-03
- mediumCVE-2026-81269: Missing Authorization vulnerability in Drupal Data field allows Forceful Browsing. This issue …nvd · 2026-09-02
More from CERT-Bund (BSI) Security Advisories
- medium[NEW] [medium] Langflow: Multiple vulnerabilities2026-09-04
- medium[NEW] [medium] Grafana Enterprise: Multiple vulnerabilities allow gaining user or administrator privileges2026-09-04
- low[NEW] [low] Checkmk: Vulnerability allows Denial of Service2026-09-04
- low[NEW] [low] ImageMagick: Multiple vulnerabilities allow Denial of Service2026-09-04
- critical[NEW] [critical] vm2: Multiple vulnerabilities allow code execution2026-09-04