CVE-2026-18259: Token Content Access - Moderately critical - Access bypass - SA-CONTRIB-2026-090
Published Aug 25, 2026
·Updated
Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. This issue affects Token Content Access versions: from 0.0.0 to 3.1.2.
Affected Software
1 affected component
Drupal Token Content Access>=0.0.0<=3.1.2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Token Content Accessto a version that resolves this vulnerability.Fixed in 3.1.2Patch SA-CONTRIB-2026-090
Event History
Aug 25, 2026
CVE Published
via MITRE·10:21 PM
Data Sourced
via MITRE·10:21 PM
DescriptionWeakness
Data Sourced
via NVD·11:16 PM
DescriptionWeakness
Frequently Asked Questions
1
How should I scope potentially affected deployments?
Treat Drupal Token Content Access versions from 0.0.0 through 3.1.2 as affected.
2
Does the available information identify a fixed upgrade version?
No fixed version is provided in the available data. It only states that versions through 3.1.2 are affected.