SA-CONTRIB-2026-308: Critical severity composer/drupal/allowed_languages vulnerability

Q: Who can exploit this issue?

A user must have permission to create content in at least one language. The issue affects attempts to enforce restrictions on which languages that user may use when creating content.

Q: What access does an attacker need?

The attacker needs authenticated access sufficient to create content in at least one language. No additional prerequisite is stated.

Published Nov 4, 2026

Updated

The Allowed Languages module makes it possible to set restrictions on which content a user can edit based on language. The module doesn't sufficiently protect against using a disallowed language during content creation. This is mitigated by the fact that the user must have access to create content in at least one language.

Credit

Marcus Johansson (marcus_johansson)

Affected Software

1 affected componentFixes available

composer/drupal/allowed_languages<2.0.3

2.0.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/allowed_languages to a version that resolves this vulnerability.
Fixed in 2.0.3

Event History

Nov 4, 2026

Advisory Published

via Drupal·12:00 AM

Data Sourced

via Drupal·12:00 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-122077

Frequently Asked Questions

Who can exploit this issue?