DRUPAL-CONTRIB-2026-328: Composer/drupal/mollie vulnerability

Q: What must an attacker be able to do to exploit this issue?

They need to send an incoming webhook call to the site. The module does not sufficiently validate that webhook, which can allow payments to be applied incorrectly.

Q: Which sites are exposed?

Sites using the composer/drupal/mollie module to accept online payments through Mollie are potentially affected. The provided information does not identify specific affected versions or configuration requirements.

Published Nov 11, 2026

Updated

This module enables you to accept online payments on your website using Mollie.

This module doesn't sufficiently validate an incoming webhook call, allowing payments to be applied incorrectly.

Affected Software

1 affected componentFixes available

composer/drupal/mollie<2.3.2

2.3.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/mollie to a version that resolves this vulnerability.
Fixed in 2.3.2

Event History

Nov 11, 2026

Advisory Published

via OSV·05:55 PM

Data Sourced

via OSV·05:55 PM

DescriptionAffected Software

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

They need to send an incoming webhook call to the site. The module does not sufficiently validate that webhook, which can allow payments to be applied incorrectly.

Which sites are exposed?

Sites using the composer/drupal/mollie module to accept online payments through Mollie are potentially affected. The provided information does not identify specific affected versions or configuration requirements.

DRUPAL-CONTRIB-2026-328: Composer/drupal/mollie vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

Which sites are exposed?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

Which sites are exposed?