SA-CONTRIB-2026-291: Critical severity composer/drupal/cms_content_sync vulnerability
This module enables you to share and reuse content across websites. The module did not sufficiently encrypt the password of the system user used when synchronizing content. This can potentially allow unprivileged users to view the password. This vulnerability is mitigated by the fact that an attacker must have access to a database dump or database read access to the user data table. This vulnerability is not exploitable without prior database access.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/cms_content_syncto a version that resolves this vulnerability.Fixed in 3.2.2
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must already have access to a database dump or read access to the user data table. It is not exploitable without prior database access.
What sensitive information could be exposed?
Unprivileged users who obtain the necessary database access may be able to view the password for the system user used to synchronize content.
How can I determine whether my environment is at risk?
Review who can read the user data table and who can obtain database dumps. Any untrusted or unprivileged party with either form of database access could potentially access the synchronization system user's password.