SA-CONTRIB-2026-190: Critical severity drupal/smart_content vulnerability
This module enables you to personalize content for anonymous and authenticated users by showing different blocks to visitors based on client-side conditions. The Smart Content Block submodule doesn't sufficiently check block access when it renders the blocks of a "Display Blocks" reaction through the module's AJAX endpoint. This vulnerability is mitigated by the fact that a site must have placed a block whose access is restricted to certain users inside a Display Blocks reaction. Sites that only use Views blocks in reactions are not affected, because Views re-checks access when the view is executed.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/smart_contentto a version that resolves this vulnerability.Fixed in 3.2.1
Event History
Frequently Asked Questions
Which sites are exposed to this issue?
A site is exposed only if it has placed a block with access restricted to certain users inside a Display Blocks reaction. Sites that use only Views blocks in reactions are not affected.
How can I determine whether my site has an affected configuration?
Review Smart Content Block Display Blocks reactions and identify any included blocks with user-restricted access. Reactions containing only Views blocks are not affected because Views re-checks access when the view executes.