PatchClock

PHP security digest · 7 Oct 2026

This module provides a new UI experience for node editing using the Gutenberg Editor library. The module does not sufficiently check entity access in several e...

Unrated CVE-2026-107263

Package
drupal/gutenberg
Fixed in
2.15.0, 3.0.7
Published
Wed 7 Oct 2026, 17:26 LisbonUpdated Mon 26 Oct 2026, 04:25 Lisbon

In plain words

An attacker may bypass entity access checks in several Gutenberg editor endpoints. They must have a role with the use gutenberg permission.

Am I affected?

Find drupal/gutenberg and its version in composer.lock. The advisory lists fixes in 2.15.0 and 3.0.7, but gives no affected version range. Check which roles have the use gutenberg permission.

What to do

Check which version you have, then update to a fixed release for your branch (2.15.0, 3.0.7):

composer show drupal/gutenberg | grep versions
composer update drupal/gutenberg

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

If you cannot update yet

The advisory says the vulnerability is mitigated by the requirement that an attacker have a role with the use gutenberg permission.

The advisory's description

This module provides a new UI experience for node editing using the Gutenberg Editor library.

The module does not sufficiently check entity access in several editor endpoints.

This vulnerability is mitigated by the fact that an attacker must have a role with the “use gutenberg” permission.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.