SA-CONTRIB-2026-109: Critical severity drupal/digital_signage_framework vulnerability
The Digital Signage Framework module provides a route that signage devices can call to refresh dynamic blocks on a display. The route did not check whether the requester was a signage device, nor whether the requested block was one that the module delivers to displays. As a result, an anonymous visitor could read the rendered content of blocks they were not meant to see. This vulnerability is mitigated by the fact that many block plugins perform their own access checks on the content they display, which limits what can be disclosed through this route.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/digital_signage_frameworkto a version that resolves this vulnerability.Fixed in 2.6.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An anonymous visitor can exploit the route because it did not verify that the requester was a signage device.
What information could be exposed?
The issue can disclose rendered content from blocks that were not intended to be delivered to displays. Disclosure may be limited where the relevant block plugin performs its own access checks.
How can I determine whether content was exposed?
Review use of the module's dynamic-block refresh route for anonymous requests and identify blocks whose rendered output could be returned through it. Blocks with independent access checks may have reduced exposure, but the provided data does not identify specific affected blocks.