{"id":"CVE-2026-81161","aliases":["DRUPAL-CONTRIB-2026-107","EUVD-2026-70004","GHSA-q382-cg62-9wjf"],"status":"published","title":"Content Moderation Notifications - Moderately critical - Access bypass - SA-CONTRIB-2026-107","description":"Privilege Defined With Unsafe Actions vulnerability in Drupal Content Moderation Notifications allows Privilege Escalation. This issue affects Content Moderation Notifications versions: from 0.0.0 to 3.9.0.","severity":{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00208,"percentile":0.11015,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-267"],"published":"2026-08-26T17:36:16Z","modified":"2026-10-28T02:31:12Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/content_moderation_notifications","fixed_in":["3.9.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/content_moderation_notifications","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0"}]}]}],"products":[{"vendor":"content_moderation_notifications_project","product":"content_moderation_notifications"},{"vendor":"drupal","product":"content moderation notifications"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2026-107","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81161","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-q382-cg62-9wjf"},{"url":"https://git.drupalcode.org/project/content_moderation_notifications","tags":["web"]},{"url":"https://www.drupal.org/project/content_moderation_notifications","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81161.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-81161","title":"Content Moderation Notifications - Moderately critical - Access bypass - SA-CONTRIB-2026-107","description":"Privilege Defined With Unsafe Actions vulnerability in Drupal Content Moderation Notifications allows Privilege Escalation. This issue affects Content Moderation Notifications versions: from 0.0.0 to 3.9.0.","status":"published","published":"2026-09-02T12:32:03.335Z","modified":"2026-09-02T19:01:16.122Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low","assessor":"adp"}],"cwes":["CWE-267"],"updated_at":"2026-11-02T13:36:18.075535Z"}],"euvd":[{"id":"EUVD-2026-70004","description":"Privilege Defined With Unsafe Actions vulnerability in Drupal Content Moderation Notifications allows Privilege Escalation. This issue affects Content Moderation Notifications versions: from 0.0.0 to 3.9.0.","status":"published","published":"2026-09-02T12:32:03Z","modified":"2026-09-02T19:01:16Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T18:01:14.689075Z"}],"ghsa":[{"id":"GHSA-q382-cg62-9wjf","title":"Privilege Defined With Unsafe Actions vulnerability in Drupal Content Moderation Notifications...","description":"Privilege Defined With Unsafe Actions vulnerability in Drupal Content Moderation Notifications allows Privilege Escalation. This issue affects Content Moderation Notifications versions: from 0.0.0 to 3.9.0.","status":"published","published":"2026-09-02T15:34:47Z","modified":"2026-09-02T21:33:05Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"cwes":["CWE-267"],"updated_at":"2026-11-02T15:11:18.49317Z"}],"nvd":[{"id":"CVE-2026-81161","description":"Privilege Defined With Unsafe Actions vulnerability in Drupal Content Moderation Notifications allows Privilege Escalation. This issue affects Content Moderation Notifications versions: from 0.0.0 to 3.9.0.","status":"published","published":"2026-09-02T13:18:11.887Z","modified":"2026-09-24T18:38:10.123Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-267"],"updated_at":"2026-11-02T14:12:43.399612Z"}],"osv":[{"id":"CVE-2026-81161","title":"Content Moderation Notifications - Moderately critical - Access bypass - SA-CONTRIB-2026-107","description":"Privilege Defined With Unsafe Actions vulnerability in Drupal Content Moderation Notifications allows Privilege Escalation. This issue affects Content Moderation Notifications versions: from 0.0.0 to 3.9.0.","status":"published","published":"2026-09-02T12:32:03.335Z","modified":"2026-10-28T02:31:12.843112766Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"cwes":["CWE-267"],"updated_at":"2026-11-02T15:45:18.131258Z"},{"id":"DRUPAL-CONTRIB-2026-107","description":"The module provides a permission that allows users to configure email templates containing Twig code. This permission was not marked as restricted.\n\nA site administrator might inadvertently grant this permission to less-trusted users. This would allow those users to execute Twig within email templates, and to gain access to functionality and information intended only for highly trusted administrators.","status":"published","published":"2026-08-26T17:36:16Z","modified":"2026-08-26T22:41:57.904046Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}