CVE-2026-122075: Composer/drupal/scheduler vulnerability

Q: Who is exposed to this issue?

Sites are exposed only where users can edit the affected content and that content is editable through a web services API such as JSON:API or REST. Users without permission to edit the affected content cannot meet the stated exploitation requirement.

Q: What could an attacker do if they exploit it?

An attacker with permission to edit affected content may be able to change publication or unpublication dates without sufficient authorization checks. This could disclose information before its intended publication time or make content inaccessible earlier or later than planned.

Published Nov 4, 2026

Updated

This module enables you to schedule content to be published or unpublished at a certain time in the future.

The module doesn't sufficiently check if a user has permission to change publication or unpublication dates. This might cause certain information to be publicly disclosed ahead of the scheduled time, or content to become inaccessible earlier or later than planned.

This vulnerability is mitigated by the fact that an attacker must already have permission to edit the affected content, and the content must be editable through a web services API like JSON:API or REST.

Affected Software

5 affected componentsFixes available

composer/drupal/scheduler<1.7.0

1.7.0

composer/drupal/scheduler>=2.2.0<2.2.3

2.2.3

composer/drupal/scheduler>=2.0.0<2.1.0

2.1.0

composer/drupal/scheduler>=2.1.0<2.2.0

2.2.0

composer/drupal/scheduler>=2.3.0<2.3.1

2.3.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/scheduler to a version that resolves this vulnerability.
Fixed in 1.7.0
Upgrade
Upgrade composer/drupal/scheduler to a version that resolves this vulnerability.
Fixed in 2.2.3
Upgrade
Upgrade composer/drupal/scheduler to a version that resolves this vulnerability.
Fixed in 2.1.0
Upgrade
Upgrade composer/drupal/scheduler to a version that resolves this vulnerability.
Fixed in 2.2.0
Upgrade
Upgrade composer/drupal/scheduler to a version that resolves this vulnerability.
Fixed in 2.3.1

Event History

Nov 4, 2026

Advisory Published

via OSV·05:35 PM

Data Sourced

via OSV·05:35 PM

DescriptionAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Sites are exposed only where users can edit the affected content and that content is editable through a web services API such as JSON:API or REST. Users without permission to edit the affected content cannot meet the stated exploitation requirement.

What could an attacker do if they exploit it?

An attacker with permission to edit affected content may be able to change publication or unpublication dates without sufficient authorization checks. This could disclose information before its intended publication time or make content inaccessible earlier or later than planned.