DRUPAL-CONTRIB-2026-311: XSS

Q: Who is realistically exposed to exploitation?

Drupal sites using composer/drupal/adobe_analytics are exposed when users who can add or edit content can work with content configured to use the module's functionality. The issue is mitigated because an attacker needs that content-add or content-edit permission.

Q: What access does an attacker need to exploit this issue?

The attacker must have permission to add or edit content that is configured to use the module's functionality. The provided information does not indicate that unauthenticated attackers can exploit it.

Published Nov 4, 2026

Updated

This module integrates the Site Catalyst or AdobeAnalytics software into a Drupal site.

The module does not sufficiently provide access controls for advanced functionality, which exposes a cross-site scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have permission to add or edit content that is configured to use the module's functionality.

Affected Software

1 affected componentFixes available

composer/drupal/adobe_analytics<1.1.0

1.1.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/adobe_analytics to a version that resolves this vulnerability.
Fixed in 1.1.0

Event History

Nov 4, 2026

Advisory Published

via OSV·05:51 PM

Data Sourced

via OSV·05:51 PM

DescriptionAffected Software

Frequently Asked Questions

Who is realistically exposed to exploitation?

Drupal sites using composer/drupal/adobe_analytics are exposed when users who can add or edit content can work with content configured to use the module's functionality. The issue is mitigated because an attacker needs that content-add or content-edit permission.

What access does an attacker need to exploit this issue?

The attacker must have permission to add or edit content that is configured to use the module's functionality. The provided information does not indicate that unauthenticated attackers can exploit it.