CVE-2026-126728: Composer/drupal/texts vulnerability
The Texts module provides key-based strings and translations for Drupal and tools for managing them.
The module does not sufficiently protect an action to restore a duplicate translation. A crafted request can cause a user with access to the translation overview to overwrite an existing translation and delete the duplicate, even if that user cannot edit or delete translations.
This vulnerability is mitigated by the fact that an attacker must first create a suitable duplicate translation and induce a user with access to the translation overview to open the crafted request.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/textsto a version that resolves this vulnerability.Fixed in 1.0.17
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Installations using the Texts module are exposed where users have access to the translation overview. Exploitation also depends on an attacker being able to create a suitable duplicate translation and persuade such a user to open a crafted request.
What impact can exploitation have?
A crafted request can overwrite an existing translation and delete the duplicate. This can occur even when the user opening the request does not have permission to edit or delete translations.
Can this be exploited solely by a user who can view the translation overview?
No. The attacker must first create a suitable duplicate translation and induce a user with translation-overview access to open the crafted request.