PatchClock

PHP security digest · 21 Oct 2026

The Dopup module provides functionality for selecting and working with Webforms. The module does not perform sufficient entity access checking in some cases an...

Unrated CVE-2026-114530

Package
drupal/dopup
Fixed in
1.0.7
Published
Wed 21 Oct 2026, 18:40 LisbonUpdated Mon 26 Oct 2026, 07:25 Lisbon

In plain words

The Dopup module may expose the titles of private Webforms because it does not sufficiently check entity access in some cases. The advisory describes exposure of titles, not the contents of those Webforms.

Am I affected?

Look for drupal/dopup and its version in composer.lock, then check whether your site uses private Webforms. The advisory lists 1.0.7 as fixed but gives no affected version range, so it does not establish which earlier versions are affected.

What to do

Check which version you have, then update to a fixed release for your branch (1.0.7):

composer show drupal/dopup | grep versions
composer update drupal/dopup

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

The advisory's description

The Dopup module provides functionality for selecting and working with Webforms.

The module does not perform sufficient entity access checking in some cases and may expose the title of private Webforms.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.