DRUPAL-CONTRIB-2026-306: Composer/drupal/scheduler vulnerability
This module enables you to schedule content to be published or unpublished at a certain time in the future.
The module doesn't sufficiently check if a user has permission to change publication or unpublication dates. This might cause certain information to be publicly disclosed ahead of the scheduled time, or content to become inaccessible earlier or later than planned.
This vulnerability is mitigated by the fact that an attacker must already have permission to edit the affected content, and the content must be editable through a web services API like JSON:API or REST.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/schedulerto a version that resolves this vulnerability.Fixed in 1.7.0 - Upgrade
Upgrade
composer/drupal/schedulerto a version that resolves this vulnerability.Fixed in 2.2.3 - Upgrade
Upgrade
composer/drupal/schedulerto a version that resolves this vulnerability.Fixed in 2.1.0 - Upgrade
Upgrade
composer/drupal/schedulerto a version that resolves this vulnerability.Fixed in 2.2.0 - Upgrade
Upgrade
composer/drupal/schedulerto a version that resolves this vulnerability.Fixed in 2.3.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Exposure requires use of the Scheduler module and an affected content item that can be edited through a web services API such as JSON:API or REST. Deployments where content is not editable through those APIs are mitigated.
What access would an attacker need?
An attacker must already have permission to edit the affected content. The issue concerns insufficient permission checks for changing that content's publication or unpublication dates.
What is the likely impact of exploitation?
An attacker could cause information to be publicly disclosed before its scheduled publication time, or cause content to become inaccessible earlier or later than intended.