CVE-2026-81161 Content Moderation Notifications - Moderately critical - Access bypass - SA-CONTRIB-2026-107
A privilege escalation vulnerability in the Drupal Content Moderation Notifications module allows attackers to gain elevated permissions.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-81161?
CVE-2026-81161 is a low-severity vulnerability in Drupal Content Moderation Notifications, published on 2 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Privilege Defined With Unsafe Actions vulnerability in Drupal Content Moderation Notifications allows Privilege Escalation. This issue affects Content Moderation Notifications versions: from 0.0.0 to 3.9.0.
Weakness: CWE-267
Which versions are affected by CVE-2026-81161?
It affects 1 product.
Linux distribution packages (1)
drupal/content_moderation_notifications Packagist:https://packages.drupal.org/8 | All versions | 3.9.0 |
Products include Content Moderation Notifications Project Content Moderation Notifications.
How do I fix CVE-2026-81161?
Upgrade to a fixed version.
Is CVE-2026-81161 being exploited?
There is no known exploitation of CVE-2026-81161 in the wild and no public exploit code.
Sources
Also known as DRUPAL-CONTRIB-2026-107, GHSA-q382-cg62-9wjf.