CVE-2026-122077: Composer/drupal/allowed_languages vulnerability

Q: Who can exploit this issue?

An authenticated user who has permission to create content in at least one language can exploit it to use a language that should be disallowed by the Allowed Languages module.

Q: What is the impact of successful exploitation?

The language-based editing restriction can be bypassed during content creation, allowing content to be created in a language the user is not permitted to use.

Published Nov 4, 2026

Updated

The Allowed Languages module makes it possible to set restrictions on which content a user can edit based on language.

The module doesn't sufficiently protect against using a disallowed language during content creation. This is mitigated by the fact that the user must have access to create content in at least one language.

Affected Software

1 affected componentFixes available

composer/drupal/allowed_languages<2.0.3

2.0.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/allowed_languages to a version that resolves this vulnerability.
Fixed in 2.0.3

Event History

Nov 4, 2026

Advisory Published

via OSV·05:50 PM

Data Sourced

via OSV·05:50 PM

DescriptionAffected Software

Frequently Asked Questions

Who can exploit this issue?

An authenticated user who has permission to create content in at least one language can exploit it to use a language that should be disallowed by the Allowed Languages module.

What is the impact of successful exploitation?

The language-based editing restriction can be bypassed during content creation, allowing content to be created in a language the user is not permitted to use.