SA-CONTRIB-2026-128: Critical severity drupal/symfony_mailer_log vulnerability
This module enables you to log the emails sent by Mailer Plus as content entities, so they can be reviewed at Reports > Mail log. The module doesn't sufficiently redact the content of the emails it logs. Account related emails are stored with their one-time login links intact, so any user who can view the log can obtain a one-time login link for any account, including user 1, and use it to log in as that account. This vulnerability is mitigated by the fact that an attacker must have a role with the permission View Drupal Symfony Mailer log entries, which in earlier releases was not marked as a restricted permission.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/symfony_mailer_logto a version that resolves this vulnerability.Fixed in 1.2.7 - Compensating control
Ensure the role permission "View Drupal Symfony Mailer log entries" is restricted (marked as a restricted permission in earlier releases), so only trusted users can view Mailer Plus email log entries at Reports > Mail log.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Any site using this module where a role can view Drupal Symfony Mailer log entries is exposed. That permission allows the role holder to access logged account-related emails containing intact one-time login links.
What access does an attacker need to exploit it?
An attacker needs a role with the View Drupal Symfony Mailer log entries permission. They can then obtain a one-time login link for any account, including user 1, from the mail log and use it to log in as that account.
Are default permissions a concern?
Earlier releases did not mark the View Drupal Symfony Mailer log entries permission as restricted. Review all roles assigned this permission, especially non-administrative roles that may have received it without recognizing its account-takeover impact.
What can be done if patching is not immediately possible?
Remove the View Drupal Symfony Mailer log entries permission from all roles that do not strictly require access to the log. Limit access to trusted administrators because log viewers can retrieve one-time login links for any account.