SA-CONTRIB-2026-118: Critical severity drupal/advanced_search vulnerability
This module enables AJAX updates for advanced search, facet, and search result blocks. The module doesn’t sufficiently check block access when arbitrary block IDs are submitted to its publicly accessible AJAX endpoint. This may allow an unauthenticated attacker to retrieve restricted block content. This vulnerability is mitigated by the fact that an attacker must know or guess a restricted block’s machine ID, and the block must contain sensitive content protected by block access or visibility restrictions.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/advanced_searchto a version that resolves this vulnerability.Fixed in 2.4.5
Event History
Frequently Asked Questions
Does exploitation require an authenticated account?
No. The affected AJAX endpoint is publicly accessible, so an unauthenticated attacker may be able to retrieve restricted block content.
What must an attacker know to retrieve restricted content?
The attacker must know or guess the machine ID of a restricted block. The block must also contain sensitive content that is protected by block access or visibility restrictions.
Which deployments are most exposed?
Deployments using this module with restricted blocks that contain sensitive content are exposed if those blocks can be identified by their machine IDs.