PatchClock

PHP security digest · 21 Oct 2026

This module lets non-administrators approve, deactivate and delete users, limited by the roles they can delegate through Role Delegation. The module doesn't su...

Unrated CVE-2026-114543

Package
drupal/simple_user_management
Fixed in
1.11.0
Published
Wed 21 Oct 2026, 18:52 Lisbon

In plain words

An attacker can approve users without sufficient checks on which roles they may delegate, and the module offers an Activate link for blocked administrators. It also fails to protect user 1 from deactivation or deletion. The attacker must have a role with one of the module's additional action permissions.

Am I affected?

Look for drupal/simple_user_management and its version in composer.lock. The advisory lists 1.11.0 as fixed but gives no affected version range. Review which roles have the module's additional action permissions and which roles they can delegate through Role Delegation.

What to do

Check which version you have, then update to a fixed release for your branch (1.11.0):

composer show drupal/simple_user_management | grep versions
composer update drupal/simple_user_management

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

If you cannot update yet

The vulnerability is mitigated by requiring the attacker to have a role with one of the module's additional action permissions.

The advisory's description

This module lets non-administrators approve, deactivate and delete users, limited by the roles they can delegate through Role Delegation.

The module doesn't sufficiently check role delegation when approving users, and offers an Activate link for blocked administrators. It also doesn't protect user 1 from being deactivated or deleted.

This vulnerability is mitigated by the fact that an attacker must have a role with one of the module's additional action permissions.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.