PatchClock

PHP security digest · 7 Oct 2026

This module enables you to "share" a view display within another website via an iframe. The module doesn't sufficiently block access to view displays. Although...

Unrated CVE-2026-107266

Package
drupal/views_share
Fixed in
2.0.1
Published
Wed 7 Oct 2026, 17:29 LisbonUpdated Mon 26 Oct 2026, 04:25 Lisbon

In plain words

The Views Share module lets a view display be shared on another website through an iframe. Insufficient access checks could let an attacker run resource-intensive views and affect site performance, although the views data is not displayed. The attacker must know the view and display IDs.

Am I affected?

Look for drupal/views_share and its version in composer.lock. The advisory lists 2.0.1 as fixed but gives no affected version range. Check whether your site has resource-intensive view displays: those are the performance concern, and an attacker must know their view and display IDs.

What to do

Check which version you have, then update to a fixed release for your branch (2.0.1):

composer show drupal/views_share | grep versions
composer update drupal/views_share

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

If you cannot update yet

The advisory says the risk is mitigated by the attacker needing to know the view and display IDs.

The advisory's description

This module enables you to "share" a view display within another website via an iframe.

The module doesn't sufficiently block access to view displays. Although the views data is not displayed, resource-intensive views could still be executed which could affect site performance.

This vulnerability is mitigated by the fact that an attacker must know the view and display IDs.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.