SA-CONTRIB-2026-278: Critical severity composer/drupal/groupexpro vulnerability
The Drupal Security Team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, read the documentation on becoming the maintainer of a project that is unsupported for security reasons.
Credit
Affected Software
Event History
Frequently Asked Questions
What should I do if this project is installed in my Drupal environment?
Treat the project as unsupported because a known security issue remains unpatched. Plan to remove or replace it, or take over maintenance under Drupal's process for projects unsupported for security reasons.
Is there a fixed release or workaround available?
The advisory does not identify a fixed release or a workaround. The issue has not been fixed by the maintainer.
How can I determine whether I am affected?
Check whether your dependency inventory includes composer/drupal/groupexpro. The advisory does not provide affected-version details, so any deployment using this project should be reviewed.