- Package
- drupal/miniorange_saml
- Fixed in
- 3.2.0
- Published
- Wed 9 Sep 2026, 18:19 LisbonUpdated Sun 25 Oct 2026, 23:26 Lisbon
In plain words
The Drupal miniorange_saml module does not properly restrict access to some administrative functionality. This could let unauthorised users access privileged functions or change configuration values intended only for privileged users.
Am I affected?
Find drupal/miniorange_saml in composer.lock and check its version. The advisory lists 3.2.0 as fixed but does not specify the affected version range. It names no additional configuration, feature or database conditions, so the package version is all there is to check.
What to do
Check which version you have, then update to a fixed release for your branch (3.2.0):
composer show drupal/miniorange_saml | grep versions
composer update drupal/miniorange_samlIf your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.
The advisory's description
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider.
The miniorange_saml module does not correctly restrict access to certain functionality intended for administrative use. This could allow unauthorized users to access functionality or modify configuration values that should only be available to privileged users.
The advisory
- OSV.dev: DRUPAL-CONTRIB-2026-141
- The week's digest, with the other advisories from 7 Sep 2026
- All advisories for drupal/miniorange_saml