PatchClock

PHP security digest · 7 Oct 2026

Actstream (short for Activity Stream) aggregates a user's activity from external services (RSS feeds, etc.) into per-user activity stream entities. The configu...

Unrated CVE-2026-107257

Package
drupal/actstream
Fixed in
2.0.1, 2.1.1
Published
Wed 7 Oct 2026, 17:22 LisbonUpdated Mon 26 Oct 2026, 04:27 Lisbon

In plain words

Actstream's configuration route does not sufficiently check that the person editing it owns the account or is a user administrator. This can let a user edit another user's activity stream configuration without the required authorisation.

Am I affected?

Look for drupal/actstream and its version in composer.lock. The advisory lists fixes in 2.0.1 and 2.1.1, but gives no affected version range. Check whether your project uses Actstream's configuration route, where the account-owner or user-administrator check is insufficient.

What to do

Check which version you have, then update to a fixed release for your branch (2.0.1, 2.1.1):

composer show drupal/actstream | grep versions
composer update drupal/actstream

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

The advisory's description

Actstream (short for Activity Stream) aggregates a user's activity from external services (RSS feeds, etc.) into per-user activity stream entities.

The configuration route does not sufficiently check that the user editing it is the account owner (or a user administrator) leading to an access bypass vulnerability.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.