SA-CONTRIB-2026-107: Critical severity drupal/content_moderation_notifications vulnerability
The module provides a permission that allows users to configure email templates containing Twig code. This permission was not marked as restricted. A site administrator might inadvertently grant this permission to less-trusted users. This would allow those users to execute Twig within email templates, and to gain access to functionality and information intended only for highly trusted administrators.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/content_moderation_notificationsto a version that resolves this vulnerability.Fixed in 8.x-3.9
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Sites are exposed if an administrator has granted the email-template configuration permission to less-trusted users. Those users can configure templates containing Twig code and access functionality or information intended for highly trusted administrators.
Does this require a default configuration change to be exploitable?
Exploitation depends on the relevant permission being granted to a less-trusted user. The issue arises because the permission was not marked as restricted, which could lead an administrator to grant it inadvertently.
What should administrators do if they cannot immediately apply a fix?
Review which roles and accounts have the permission to configure email templates containing Twig code. Remove it from less-trusted users and restrict it to highly trusted administrators.