- Package
- drupal/fasttoggle
- Fixed in
- 4.1.1
- Published
- Wed 28 Oct 2026, 17:27 LisbonUpdated Mon 2 Nov 2026, 07:25 Lisbon
In plain words
A user with the "Use Fasttoggle" permission can change a node or comment through its toggle URL without permission to update that item. For example, they could publish an unpublished draft they are not allowed to view.
Am I affected?
Look for drupal/fasttoggle and its installed version in composer.lock. The advisory lists 4.1.1 as fixed but gives no affected version range. Check which roles have the "Use Fasttoggle" permission, since an attacker must have that permission.
What to do
Check which version you have, then update to a fixed release for your branch (4.1.1):
composer show drupal/fasttoggle | grep versions
composer update drupal/fasttoggleIf your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.
If you cannot update yet
Restrict the "Use Fasttoggle" permission, which an attacker must have to exploit this flaw.
The advisory's description
This module enables you to quickly toggle the publication status, promotion and stickiness of nodes, and the publication status of comments, from links on the page.
The module doesn't sufficiently check access to the entity being toggled, under the scenario where a user with the "Use Fasttoggle" permission submits a request to the toggle URL for any node or comment regardless of their permission to update that entity. For example, such a user could publish an unpublished draft they are not allowed to view.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Use Fasttoggle".