SA-CONTRIB-2026-319: Critical severity composer/drupal/texts vulnerability
The Texts module provides key-based strings and translations for Drupal and tools for managing them. The module does not sufficiently protect an action to restore a duplicate translation. A crafted request can cause a user with access to the translation overview to overwrite an existing translation and delete the duplicate, even if that user cannot edit or delete translations. This vulnerability is mitigated by the fact that an attacker must first create a suitable duplicate translation and induce a user with access to the translation overview to open the crafted request.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/textsto a version that resolves this vulnerability.Fixed in 1.0.17
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Sites using the Texts module are exposed where users can access the translation overview. Exploitation also depends on an attacker being able to create a suitable duplicate translation and persuade such a user to open a crafted request.
What level of access does an attacker need?
The attacker must first be able to create a suitable duplicate translation. They do not need permission to edit or delete translations if they can induce a user with access to the translation overview to open the crafted request.
What is the impact of a successful exploit?
A crafted request can overwrite an existing translation and delete the duplicate translation. This can occur even when the affected user lacks edit or delete permissions for translations.