SA-CONTRIB-2026-216: Critical severity drupal/restrict_route_by_ip vulnerability

Q: Which deployments are most likely to be exposed?

Sites using this module to protect dynamic routes are the relevant population. The impact depends on both the site’s use of the module and whether it has dynamic routes.

Q: Are all IP-restricted routes necessarily affected?

No. The issue is described as unreliable restriction of a subset of dynamic routes, not a failure affecting every route.

Q: How should I prioritize investigation?

Review dynamic routes that are intended to be limited by IP address through this module. Those routes should be treated as potentially accessible despite the configured restriction.

Published Oct 7, 2026

Updated

This module enables you to restrict access to routes by IP address. The module doesn't reliably restrict a subset of dynamic routes, leading to an access bypass vulnerability. The impact depends on how a site uses this module and whether it has any routes that are dynamic.

Credit

Elia Wehbe (ewehbe)

Affected Software

1 affected componentFixes available

drupal/restrict_route_by_ip<2.0.1, <1.3.1

2.0.11.3.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade drupal/restrict_route_by_ip to a version that resolves this vulnerability.
Fixed in 2.0.1Fixed in 1.3.1

Event History

Oct 7, 2026

Advisory Published

via Drupal·12:00 AM

Data Sourced

via Drupal·12:00 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-107255

Frequently Asked Questions

Which deployments are most likely to be exposed?

Sites using this module to protect dynamic routes are the relevant population. The impact depends on both the site’s use of the module and whether it has dynamic routes.

Are all IP-restricted routes necessarily affected?

No. The issue is described as unreliable restriction of a subset of dynamic routes, not a failure affecting every route.

How should I prioritize investigation?

Review dynamic routes that are intended to be limited by IP address through this module. Those routes should be treated as potentially accessible despite the configured restriction.

SA-CONTRIB-2026-216: Critical severity drupal/restrict_route_by_ip vulnerability

Credit

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments are most likely to be exposed?

Are all IP-restricted routes necessarily affected?

How should I prioritize investigation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are most likely to be exposed?

Are all IP-restricted routes necessarily affected?

How should I prioritize investigation?