SA-CONTRIB-2026-227: Critical severity drupal/dopup vulnerability

Q: What information can be exposed?

In some cases, insufficient entity access checking may expose the title of private Webforms.

Q: What type of access-control issue is involved?

The issue is insufficient entity access checking by the Dopup module when selecting or working with Webforms.

Published Oct 21, 2026

Updated

The Dopup module provides functionality for selecting and working with Webforms. The module does not perform sufficient entity access checking in some cases and may expose the title of private Webforms.

Credit

Marcus Johansson (marcus_johansson), Rodel Duterte (rduterte)

Affected Software

1 affected componentFixes available

drupal/dopup<1.0.7

1.0.7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade drupal/dopup to a version that resolves this vulnerability.
Fixed in 1.0.7

Event History

Oct 21, 2026

Advisory Published

via Drupal·12:00 AM

Data Sourced

via Drupal·12:00 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-114530

Frequently Asked Questions

What information can be exposed?

In some cases, insufficient entity access checking may expose the title of private Webforms.

What type of access-control issue is involved?

The issue is insufficient entity access checking by the Dopup module when selecting or working with Webforms.

SA-CONTRIB-2026-227: Critical severity drupal/dopup vulnerability

Credit

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What information can be exposed?

What type of access-control issue is involved?

Company

Resources

Contact

Frequently Asked Questions

What information can be exposed?

What type of access-control issue is involved?