CVE-2026-118565
GroupEx PRO ( Daxko ) integration - Critical - Unsupported - SA-CONTRIB-2026-278
Vulnerability in Drupal GroupEx PRO ( Daxko ) integration. This issue affects GroupEx PRO ( Daxko ) integration versions: ..
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
GroupEx PRO ( Daxko ) integration - Critical - Unsupported - SA-CONTRIB-2026-278
Vulnerability in Drupal GroupEx PRO ( Daxko ) integration. This issue affects GroupEx PRO ( Daxko ) integration versions: ..
- Record
CVE-2026-118565- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-06
EUVDEUVD-2026-113696
Vulnerability in Drupal GroupEx PRO ( Daxko ) integration. This issue affects GroupEx PRO ( Daxko ) integration versions: ..
- Record
EUVD-2026-113696- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-06
GitHub AdvisoriesGHSA-cqqc-gjw7-vvxw
Vulnerability in Drupal GroupEx PRO ( Daxko ) integration. This issue affects GroupEx PRO (...
Vulnerability in Drupal GroupEx PRO ( Daxko ) integration. This issue affects GroupEx PRO ( Daxko ) integration versions: ..
- Record
GHSA-cqqc-gjw7-vvxw- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-06
NVD
Vulnerability in Drupal GroupEx PRO ( Daxko ) integration. This issue affects GroupEx PRO ( Daxko ) integration versions: ..
- Record
CVE-2026-118565- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-06
OSVDRUPAL-CONTRIB-2026-278 No score
Integration with GroupEx PRO system, decoupled from Open Y.
The module does not sufficiently validate user inputs in some scenarios, potentially leading to arbitrary remote code execution.
Note: This project was marked as Unsupported by the Drupal Security Team on 2026-10-28 but a fix was released and the project restored on 2026-11-04.
- Record
DRUPAL-CONTRIB-2026-278- Updated
- 2026-11-04
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/groupexproPackagist:https://packages.drupal.org/8 |
before 2.2.1 | 2.2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| cwes, severity | CVE List, EUVD | |
| affected, facts, published | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-118565 is a high vulnerability (CVSS 7.2) in Drupal Groupex Pro ( Daxko ) Integration, published October 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 22nd percentile. Fixed in drupal/groupexpro 2.2.1.