SA-CONTRIB-2026-205: Critical severity drupal/views_share vulnerability

Q: What does an attacker need to target a vulnerable view display?

The attacker must know the relevant view ID and display ID. This requirement mitigates the issue but does not prevent execution of a resource-intensive view.

Q: What is the practical impact if this is exploited?

The view data is not displayed, but a resource-intensive view can still be executed. Repeated execution could affect site performance.

Published Oct 7, 2026

Updated

This module enables you to "share" a view display within another website via an iframe. The module doesn't sufficiently block access to view displays. Although the views data is not displayed, resource-intensive views could still be executed which could affect site performance. This vulnerability is mitigated by the fact that an attacker must know the view and display IDs.

Credit

Hemant Gupta (guptahemant)

Affected Software

1 affected componentFixes available

drupal/views_share<2.0.1

2.0.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade drupal/views_share to a version that resolves this vulnerability.
Fixed in 2.0.1

Event History

Oct 7, 2026

Advisory Published

via Drupal·12:00 AM

Data Sourced

via Drupal·12:00 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-107266

Frequently Asked Questions

What does an attacker need to target a vulnerable view display?