SA-CONTRIB-2026-233: Critical severity drupal/swiper_formatter vulnerability

Q: Who could be exposed to unauthorized content access?

Users who can reach the module's dialog route may be able to view rendered output for published content entities without the route adequately checking their access to the specific entity. Field-level access controls still apply to the returned output.

Q: Are unpublished entities exposed?

The provided information identifies the route as displaying published content entities. It does not indicate that unpublished entities are affected.

Q: What information could be disclosed?

Only rendered output is returned through the affected route, and field-level access controls remain enforced. The data does not establish that fields protected by field-level access controls are exposed.

Published Oct 21, 2026

Updated

Swiper is mobile first, layout and gestures wise, it provides great amount of options for designing your own widget and related events. This module provides a route for displaying published content entities in a dialog. The route does not sufficiently verify the current user's access to the specific entity. This vulnerability is mitigated by the fact that only rendered output is returned, and field-level access controls are still enforced.

Credit

Ryan Solomon (phizes), Julian Pustkuchen (anybody), Joshua Sedler (grevil)

Affected Software

1 affected componentFixes available

drupal/swiper_formatter<3.1.0, <2.1.2

3.1.02.1.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade drupal/swiper_formatter to a version that resolves this vulnerability.
Fixed in 3.1.0Fixed in 2.1.2

Event History

Oct 21, 2026

Advisory Published

via Drupal·12:00 AM

Data Sourced

via Drupal·12:00 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-114535

Frequently Asked Questions

Who could be exposed to unauthorized content access?

Users who can reach the module's dialog route may be able to view rendered output for published content entities without the route adequately checking their access to the specific entity. Field-level access controls still apply to the returned output.

Are unpublished entities exposed?

The provided information identifies the route as displaying published content entities. It does not indicate that unpublished entities are affected.

What information could be disclosed?

Only rendered output is returned through the affected route, and field-level access controls remain enforced. The data does not establish that fields protected by field-level access controls are exposed.

SA-CONTRIB-2026-233: Critical severity drupal/swiper_formatter vulnerability

Credit

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who could be exposed to unauthorized content access?

Are unpublished entities exposed?

What information could be disclosed?

Company

Resources

Contact

Frequently Asked Questions

Who could be exposed to unauthorized content access?

Are unpublished entities exposed?

What information could be disclosed?