- Package
- drupal/cms_content_sync
- Fixed in
- 3.2.2
- Published
- Wed 28 Oct 2026, 17:49 LisbonUpdated Mon 2 Nov 2026, 07:25 Lisbon
In plain words
The module does not sufficiently encrypt the password of the system user used to synchronise content. An unprivileged user could potentially view that password, but only if they already have a database dump or database read access to the user data table. The flaw is not exploitable without prior database access.
Am I affected?
Look for drupal/cms_content_sync and its installed version in composer.lock. The advisory lists 3.2.2 as fixed but gives no affected version range. Check whether an unprivileged user could access a database dump or read the user data table, as prior database access is required.
What to do
Check which version you have, then update to a fixed release for your branch (3.2.2):
composer show drupal/cms_content_sync | grep versions
composer update drupal/cms_content_syncIf your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.
If you cannot update yet
The vulnerability is mitigated by the requirement for an attacker to have access to a database dump or database read access to the user data table.
The advisory's description
This module enables you to share and reuse content across websites.
The module did not sufficiently encrypt the password of the system user used when synchronizing content. This can potentially allow unprivileged users to view the password.
This vulnerability is mitigated by the fact that an attacker must have access to a database dump or database read access to the user data table. This vulnerability is not exploitable without prior database access.