DRUPAL-CONTRIB-2026-308: Composer/drupal/allowed_languages vulnerability

Q: Who can exploit this issue?

A user must have permission to create content in at least one language. Such a user may be able to create content using a language that is disallowed by the module's configured restrictions.

Q: Are users who cannot create content affected?

The provided mitigation states that exploitation requires access to create content in at least one language. Users without content-creation access do not meet that prerequisite.

Published Nov 4, 2026

Updated

The Allowed Languages module makes it possible to set restrictions on which content a user can edit based on language.

The module doesn't sufficiently protect against using a disallowed language during content creation. This is mitigated by the fact that the user must have access to create content in at least one language.

Affected Software

1 affected componentFixes available

composer/drupal/allowed_languages<2.0.3

2.0.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/allowed_languages to a version that resolves this vulnerability.
Fixed in 2.0.3
Compensating control
Ensure users have access to create content in at least one language when using the Allowed Languages module.

Event History

Nov 4, 2026

Advisory Published

via OSV·05:50 PM

Data Sourced

via OSV·05:50 PM

DescriptionAffected Software

Frequently Asked Questions

Who can exploit this issue?

A user must have permission to create content in at least one language. Such a user may be able to create content using a language that is disallowed by the module's configured restrictions.

Are users who cannot create content affected?

The provided mitigation states that exploitation requires access to create content in at least one language. Users without content-creation access do not meet that prerequisite.