PatchClock

PHP security digest · 21 Oct 2026

This module enables you to share users, content and configuration across a group of domains from a single Drupal installation. Its Domain Access submodule contr...

Unrated DRUPAL-CONTRIB-2026-238

Package
drupal/domain
Fixed in
3.0.2
Published
Wed 21 Oct 2026, 18:50 Lisbon

In plain words

The Domain Access submodule does not properly check a user's assigned domains when per-content-type grants are enabled, potentially allowing them to edit or delete content on domains they are not assigned to. The attacker must be assigned to at least one domain and have the relevant general and per-content-type permissions.

Am I affected?

Find drupal/domain and its version in composer.lock. The advisory lists 3.0.2 as fixed but gives no affected version range. Check whether Domain Access's optional per-content-type grants setting is enabled; it is off by default. Then check whether a user assigned to at least one domain has Edit any content on assigned domains or Delete any content on assigned domains, together with a per-content-type permission such as Article: Edit any content on assigned domains.

What to do

Check which version you have, then update to a fixed release for your branch (3.0.2):

composer show drupal/domain | grep versions
composer update drupal/domain

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

If you cannot update yet

Leave the optional per-content-type grants setting disabled, which is its default state.

The advisory's description

This module enables you to share users, content and configuration across a group of domains from a single Drupal installation. Its Domain Access submodule controls which domains a user may edit content on, and has an optional setting to grant user access per content type.

The module doesn't sufficiently check which domains a user is assigned to when the per-content-type grant setting is enabled.

This vulnerability is mitigated by the fact that the per-content-type grants setting must be enabled (it is off by default), and an attacker must have a role with the permission "Edit any content on assigned domains" or "Delete any content on assigned domains" together with a per-content-type permission such as "Article: Edit any content on assigned domains", and must be assigned to at least one domain.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.