DRUPAL-CONTRIB-2026-319

See a problem?
Import Source
https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/texts/DRUPAL-CONTRIB-2026-319.json
JSON Data
https://api.osv.dev/v1/vulns/DRUPAL-CONTRIB-2026-319
Aliases
  • CVE-2026-126728
Published
2026-11-11T17:42:35Z
Modified
2026-11-11T18:45:03Z
Summary
[none]
Details

The Texts module provides key-based strings and translations for Drupal and tools for managing them.

The module does not sufficiently protect an action to restore a duplicate translation. A crafted request can cause a user with access to the translation overview to overwrite an existing translation and delete the duplicate, even if that user cannot edit or delete translations.

This vulnerability is mitigated by the fact that an attacker must first create a suitable duplicate translation and induce a user with access to the translation overview to open the crafted request.

References
Credits

Affected packages

Packagist:https://packages.drupal.org/8 / drupal/texts

Package

Name
drupal/texts
Purl
pkg:composer/drupal/texts?repository_url=https:%2F%2Fpackages.drupal.org%2F8

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.0.13
Fixed
1.0.17
Database specific
Show details 
{
    "constraint": ">=1.0.13 <1.0.17"
}

Database specific

affected_versions 
">=1.0.13 <1.0.17"
source 
"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/texts/DRUPAL-CONTRIB-2026-319.json"