Critical PHP2Shell: two unauthenticated RCE flaws in PHP itself. Fixes shipped on 21 Oct 2026. Check if you are affected →
日本語 Contact
← All news

Drupal's November 4 Batch: 24 Contrib Advisories, Including an API Auth Bypass, a Content Synchronizer RCE and Two Fake-Payment Webhooks

On November 4, 2026 the Drupal Security Team published 24 advisories for contributed modules. The most urgent are an authentication bypass in REST & JSON API Authentication (CVE-2026-122067, fixed in 3.2.1) and a PHP object injection RCE in Content Synchronizer (CVE-2026-118547, fixed in 4.1.1).

On November 4, 2026 the Drupal Security Team published a large batch of advisories for contributed modules: SA-CONTRIB-2026-293 through SA-CONTRIB-2026-315, plus SA-CONTRIB-2026-278, which covers a module that has been fixed and restored. That is 24 advisories in one day, on top of the 28 October batch.

Core is not affected. But many sites run at least one of these modules, and several of the flaws can be reached without logging in.

The two to check first

REST & JSON API Authentication (rest_api_authentication), SA-CONTRIB-2026-298

  • Risk: Critical (17/25), access bypass, CVE-2026-122067.
  • Affected: versions below 3.2.1.
  • What happens: the module did not reject requests when the API key was never configured. On sites where API authentication is enabled but the application API key has not been generated, an unauthenticated attacker could bypass authentication and potentially read or change protected resources.
  • Fix: upgrade to 3.2.1. If you can't upgrade right away, Drupal advises generating an API key and checking logs for suspicious activity by administrative users.

Content Synchronizer (content_synchronizer), SA-CONTRIB-2026-293

  • Risk: Critical (17/25), remote code execution, CVE-2026-118547.
  • Affected: versions below 4.1.1.
  • What happens: a crafted import archive can make the module deserialize untrusted data (PHP object injection, CWE-502), which can lead to code execution. A separate advisory, SA-CONTRIB-2026-294 (CVE-2026-118566), fixes a DOM-based XSS in the same module.
  • Fix: upgrade to 4.1.1.

This is the second content import module in a week with a deserialization RCE. Single Content Sync received the same kind of fix on 28 October (SA-CONTRIB-2026-275).

Payment and commerce flaws

Three advisories affect online shops directly:

  • Commerce Escrow (SA-CONTRIB-2026-302, CVE-2026-122071): Escrow.com webhooks were not properly verified. An attacker could forge status updates, marking unpaid orders as paid or completed, or cancelling orders in progress.
  • AlternativeCommerce PayPal Checkout (basket_paypal, SA-CONTRIB-2026-300, CVE-2026-122069): an unauthenticated, crafted webhook request could mark an order as paid without any payment.
  • Commerce Product Alternative (SA-CONTRIB-2026-301, Critical, CVE-2026-122070): anonymous visitors could view other anonymous visitors' carts, including product names and prices, and swap items in them.

If you run either payment module, update it and then compare recent "paid" orders against what actually arrived at Escrow.com or PayPal.

Other critical advisories in the batch

  • Simple OAuth (OAuth2) & OpenID Connect (SA-CONTRIB-2026-296, CVE-2026-122058): users who can create or edit consumers could configure a malicious consumer and obtain tokens with more privileges, up to full admin access.
  • Workflow Notifications (SA-CONTRIB-2026-297, CVE-2026-122066): the notification settings page was not protected against unauthorized changes.
  • Highlight Js syntax highlighter (SA-CONTRIB-2026-299, CVE-2026-122068): reflected XSS through its CKEditor 5 preview endpoint.
  • S3 File System CORS Upload (SA-CONTRIB-2026-295, CVE-2026-122057): in some cases users could delete files they should not have access to.
  • Reset Password Email/SMS OTP (SA-CONTRIB-2026-305, CVE-2026-122074): passwords could be reset for blocked users, which matters once an admin unblocks them.
  • GroupEx PRO (Daxko) integration (SA-CONTRIB-2026-278, CVE-2026-118565): PHP object injection that could lead to RCE. The project had been marked unsupported on 28 October; a fix was released and the project restored on 4 November.

Moderately and less critical

The rest of the batch covers XSS in htmLawed (two advisories, one affecting sites on Drupal core above 11.2 or any core with the HTMX library), Extended HTML Filter, AdobeAnalytics and Name Field; an admin-level SQL injection in WordsOnline Connector; access bypasses in Islandora (file overwrite), Scheduler, Forum Access, Password Separate Form and Allowed Languages; and an information disclosure in Mime Mail.

A pattern worth noticing: several of these (htmLawed, Extended HTML Filter, and the AI module on 28 October) are about filters that don't account for HTMX attributes. If you maintain a custom text filter or sanitizer, check it against HTMX attributes too.

What to do

  1. Run composer outdated "drupal/*" or check the Available updates report to see which of these modules you have.
  2. Update each one to the version listed in its advisory on the Drupal contrib security advisories page.
  3. For the payment modules, reconcile recent orders with your payment provider.
  4. For REST & JSON API Authentication, make sure an API key is generated even after updating.

Older Drupal 7, 8 or 9 sites usually can't take these module releases at all, because the fixed versions target supported core. If you're stuck on an old core and need these fixes backported, or need help planning the move to a supported version, RescuePHP can help.