PatchClock

PHP security digest · 7 Oct 2026

This module enables you to restrict access to routes by IP address. The module doesn't reliably restrict a subset of dynamic routes, leading to an access bypas...

Unrated CVE-2026-107255

Package
drupal/restrict_route_by_ip
Fixed in
1.3.1, 2.0.1
Published
Wed 7 Oct 2026, 17:55 LisbonUpdated Mon 26 Oct 2026, 04:26 Lisbon

In plain words

The module can fail to enforce IP address restrictions on some dynamic routes, allowing access that should be blocked. The impact depends on how the site uses the module and whether it has dynamic routes.

Am I affected?

Look for drupal/restrict_route_by_ip and its installed version in composer.lock. The advisory lists 1.3.1 and 2.0.1 as fixed versions but gives no affected version ranges. Check whether your site uses the module to restrict dynamic routes by IP address, as only a subset of dynamic routes is affected.

What to do

Check which version you have, then update to a fixed release for your branch (1.3.1, 2.0.1):

composer show drupal/restrict_route_by_ip | grep versions
composer update drupal/restrict_route_by_ip

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

The advisory's description

This module enables you to restrict access to routes by IP address.

The module doesn't reliably restrict a subset of dynamic routes, leading to an access bypass vulnerability. The impact depends on how a site uses this module and whether it has any routes that are dynamic.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.