SA-CONTRIB-2026-280: Critical severity composer/drupal/bulk_update_user_roles vulnerability
This module provides a bulk form for assigning or removing roles on multiple user accounts at once. The bulk update form does not prevent access to users who do not have permission to assign roles. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer users".
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/bulk_update_user_rolesto a version that resolves this vulnerability.Fixed in 1.0.5
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Sites using composer/drupal/bulk_update_user_roles are exposed if a user has a role with the "administer users" permission. The issue affects access to the module's bulk role update form.
What does an attacker need to exploit it?
An attacker must already hold a role that includes the "administer users" permission. The advisory identifies this permission requirement as a mitigating factor.