- Package
- drupal/bulk_update_user_roles
- Fixed in
- 1.0.5
- Published
- Wed 28 Oct 2026, 17:33 LisbonUpdated Mon 2 Nov 2026, 07:25 Lisbon
In plain words
The bulk role update form lets users assign or remove roles on multiple accounts without permission to assign roles. An attacker must have a role with the "administer users" permission to use the flaw.
Am I affected?
Check composer.lock for drupal/bulk_update_user_roles and its installed version. The advisory lists 1.0.5 as fixed but gives no affected version range. Review which roles have the administer users permission, particularly roles without permission to assign roles.
What to do
Check which version you have, then update to a fixed release for your branch (1.0.5):
composer show drupal/bulk_update_user_roles | grep versions
composer update drupal/bulk_update_user_rolesIf your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.
If you cannot update yet
The vulnerability is mitigated by the requirement that an attacker have a role with the administer users permission.
The advisory's description
This module provides a bulk form for assigning or removing roles on multiple user accounts at once.
The bulk update form does not prevent access to users who do not have permission to assign roles.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer users".