DRUPAL-CONTRIB-2026-329: Composer/drupal/mollie vulnerability

Q: Which sites are affected by this issue?

The issue is mitigated unless the mollie_webform submodule is enabled. Sites using the Mollie module without that submodule enabled are not identified as affected by the available information.

Q: What could be exposed if the vulnerability is exploited?

In some cases, the Mollie secret token can be exposed. The provided information does not specify the conditions that cause exposure or an exploitation method.

Published Nov 11, 2026

Updated

This module enables you to accept online payments on your website using Mollie.

In some cases the Mollie secret token can be exposed.

This vulnerability is mitigated by the fact that the molliewebform submodule must be enabled.

Affected Software

1 affected componentFixes available

composer/drupal/mollie<2.3.2

2.3.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/mollie to a version that resolves this vulnerability.
Fixed in 2.3.2
Configuration
Enable the mollie_webform submodule to mitigate exposure of the Mollie secret token.
Mollie payment module mollie_webform = enabled

Event History

Nov 11, 2026

Advisory Published

via OSV·05:56 PM

Data Sourced

via OSV·05:56 PM

DescriptionAffected Software

Frequently Asked Questions

Which sites are affected by this issue?

The issue is mitigated unless the mollie_webform submodule is enabled. Sites using the Mollie module without that submodule enabled are not identified as affected by the available information.

What could be exposed if the vulnerability is exploited?

In some cases, the Mollie secret token can be exposed. The provided information does not specify the conditions that cause exposure or an exploitation method.

DRUPAL-CONTRIB-2026-329: Composer/drupal/mollie vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which sites are affected by this issue?

What could be exposed if the vulnerability is exploited?

Company

Resources

Contact

Frequently Asked Questions

Which sites are affected by this issue?

What could be exposed if the vulnerability is exploited?