CVE-2026-126740: Composer/drupal/download_count vulnerability
This module tracks file downloads for private files and provides reports about them.
The module provides the permissions that are never actually checked. A user with only the View download counts permission could export the download log and delete all download records.
This vulnerability is mitigated by the fact that an attacker must have an account with the View download counts permission.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/download_countto a version that resolves this vulnerability.Fixed in 2.2.5 - Upgrade
Upgrade
composer/drupal/download_countto a version that resolves this vulnerability.Fixed in 3.0.2
Event History
Frequently Asked Questions
Who is able to exploit this issue?
An authenticated user with the View download counts permission can exploit it. The issue is mitigated by requiring an account that has this permission.
What actions can an affected user perform beyond viewing counts?
A user with only the View download counts permission can export the download log and delete all download records.
How can I determine whether my site is exposed?
Review accounts and roles assigned the View download counts permission. Any such account may be able to export download logs and delete download records.