DRUPAL-CONTRIB-2026-306

See a problem?
Import Source
https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/scheduler/DRUPAL-CONTRIB-2026-306.json
JSON Data
https://api.osv.dev/v1/vulns/DRUPAL-CONTRIB-2026-306
Aliases
  • CVE-2026-122075
Published
2026-11-04T17:35:07Z
Modified
2026-11-04T20:30:03Z
Summary
[none]
Details

This module enables you to schedule content to be published or unpublished at a certain time in the future.

The module doesn't sufficiently check if a user has permission to change publication or unpublication dates. This might cause certain information to be publicly disclosed ahead of the scheduled time, or content to become inaccessible earlier or later than planned.

This vulnerability is mitigated by the fact that an attacker must already have permission to edit the affected content, and the content must be editable through a web services API like JSON:API or REST.

References
Credits

Affected packages

Packagist:https://packages.drupal.org/8 / drupal/scheduler

Package

Name
drupal/scheduler
Purl
pkg:composer/drupal/scheduler?repository_url=https:%2F%2Fpackages.drupal.org%2F8

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.7.0
Database specific
Show details 
{
    "constraint": "<1.7.0"
}
Type
ECOSYSTEM
Events
Introduced
2.2.0
Fixed
2.2.3
Database specific
Show details 
{
    "constraint": ">=2.2.0 <2.2.3"
}
Type
ECOSYSTEM
Events
Introduced
2.0.0
Fixed
2.1.0
Database specific
Show details 
{
    "constraint": "2.0.*"
}
Type
ECOSYSTEM
Events
Introduced
2.1.0
Fixed
2.2.0
Database specific
Show details 
{
    "constraint": "2.1.*"
}
Type
ECOSYSTEM
Events
Introduced
2.3.0
Fixed
2.3.1
Database specific
Show details 
{
    "constraint": ">= 2.3.0 <2.3.1"
}

Database specific

affected_versions 
"<1.7.0 || >=2.2.0 <2.2.3 || 2.0.* || 2.1.* || >= 2.3.0 <2.3.1"
source 
"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/scheduler/DRUPAL-CONTRIB-2026-306.json"