DRUPAL-CONTRIB-2026-280: Composer/drupal/bulk_update_user_roles vulnerability
Published Oct 28, 2026
·Updated
This module provides a bulk form for assigning or removing roles on multiple user accounts at once.
The bulk update form does not prevent access to users who do not have permission to assign roles.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer users".
Affected Software
1 affected componentFixes available
composer/drupal/bulk_update_user_roles<1.0.5
1.0.5
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/bulk_update_user_rolesto a version that resolves this vulnerability.Fixed in 1.0.5
Event History
Oct 28, 2026
Advisory Published
via OSV·05:33 PM
Data Sourced
via OSV·05:33 PM
DescriptionAffected Software