SA-CONTRIB-2026-183: Critical severity drupal/stop_admin vulnerability
This module enables sites to block access for the administrative user account (user 1) or users with the administrator role. The module does not sufficiently enforce these access restrictions across all supported authentication mechanisms. As a result, a blocked administrative user may still be able to authenticate through certain alternative authentication methods. This vulnerability is mitigated by the fact that an attacker must possess valid credentials for a user with the administrator role, and must authenticate using a less commonly used authentication mechanism.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/stop_adminto a version that resolves this vulnerability.Fixed in 8.x-1.6
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must already possess valid credentials for a user with the administrator role. They must also authenticate through a less commonly used authentication mechanism that does not sufficiently enforce the module's blocking restrictions.
Are sites using the module's normal administrative access blocking fully protected?
No. The module does not enforce its restrictions across all supported authentication mechanisms, so blocking user 1 or administrator-role users may be bypassed through certain alternative authentication methods.
What should be reviewed while remediation is pending?
Review accounts with the administrator role, especially any that are intended to be blocked, and review use of alternative authentication mechanisms. Valid administrator credentials can allow a blocked account to authenticate through an affected mechanism.