PatchClock

PHP security digest · 21 Oct 2026

Swiper is mobile first, layout and gestures wise, it provides great amount of options for designing your own widget and related events. This module provides a...

Unrated CVE-2026-114535

Package
drupal/swiper_formatter
Fixed in
2.1.2, 3.1.0
Published
Wed 21 Oct 2026, 18:46 Lisbon

In plain words

The module has a route that displays published content entities in a dialogue without sufficiently checking whether the current user can access the specific entity. This can let a user view rendered content from an entity they are not allowed to access. Only rendered output is returned, and field-level access controls remain enforced.

Am I affected?

Look for drupal/swiper_formatter and its version in composer.lock. The advisory lists 2.1.2 and 3.1.0 as fixed versions but gives no affected version range. The flaw concerns the module's route for displaying published content entities in a dialogue; no additional configuration or database condition is named.

What to do

Check which version you have, then update to a fixed release for your branch (2.1.2, 3.1.0):

composer show drupal/swiper_formatter | grep versions
composer update drupal/swiper_formatter

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

If you cannot update yet

The impact is limited because only rendered output is returned and field-level access controls are still enforced.

The advisory's description

Swiper is mobile first, layout and gestures wise, it provides great amount of options for designing your own widget and related events.

This module provides a route for displaying published content entities in a dialog. The route does not sufficiently verify the current user's access to the specific entity.

This vulnerability is mitigated by the fact that only rendered output is returned, and field-level access controls are still enforced.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.