DRUPAL-CONTRIB-2026-308

Import Source

https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/allowed_languages/DRUPAL-CONTRIB-2026-308.json

JSON Data

https://api.osv.dev/v1/vulns/DRUPAL-CONTRIB-2026-308

Aliases

CVE-2026-122077

Published

2026-11-04T17:50:52Z

Modified

2026-11-04T20:30:02Z

Summary

[none]

Details

The Allowed Languages module makes it possible to set restrictions on which content a user can edit based on language.

The module doesn't sufficiently protect against using a disallowed language during content creation. This is mitigated by the fact that the user must have access to create content in at least one language.

References

https://www.drupal.org/sa-contrib-2026-308

Credits

- Marcus Johansson (marcus_johansson)
- - https://www.drupal.org/u/marcus_johansson

Affected packages

Packagist:https://packages.drupal.org/8 / drupal/allowed_languages

Package

Name: drupal/allowed_languages
Purl: pkg:composer/drupal/allowed_languages?repository_url=https:%2F%2Fpackages.drupal.org%2F8

Affected ranges

Type

ECOSYSTEM

Events

Introduced

Fixed

2.0.3

Database specific

Show details

{
    "constraint": "<2.0.3"
}

Database specific

affected_versions

"<2.0.3"

source

"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/allowed_languages/DRUPAL-CONTRIB-2026-308.json"