CVE-2026-122083: XSS

Q: Who is exposed to this vulnerability?

Drupal sites using the module are exposed when content is configured to use the module's functionality and users have permission to add or edit that content.

Q: What level of access does an attacker need to exploit it?

An attacker must be able to add or edit content that is configured to use the module's functionality. The issue is therefore not exploitable by users who lack those content permissions.

Published Nov 4, 2026

Updated

This module integrates the Site Catalyst or AdobeAnalytics software into a Drupal site.

The module does not sufficiently provide access controls for advanced functionality, which exposes a cross-site scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have permission to add or edit content that is configured to use the module's functionality.

Affected Software

1 affected componentFixes available

composer/drupal/adobe_analytics<1.1.0

1.1.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/adobe_analytics to a version that resolves this vulnerability.
Fixed in 1.1.0

Event History

Nov 4, 2026

Advisory Published

via OSV·05:51 PM

Data Sourced

via OSV·05:51 PM

DescriptionAffected Software

Frequently Asked Questions

Who is exposed to this vulnerability?

Drupal sites using the module are exposed when content is configured to use the module's functionality and users have permission to add or edit that content.

What level of access does an attacker need to exploit it?

An attacker must be able to add or edit content that is configured to use the module's functionality. The issue is therefore not exploitable by users who lack those content permissions.