Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    Related vulnerabilities

    DRUPAL-CONTRIB-2026-198 (CVE-2026-107257)

    Vulnerability from drupal – Published: 2026-10-07 16:22 – Updated: 2026-10-07 16:22 – Source website
    VLAI
    Details

    Actstream (short for Activity Stream) aggregates a user's activity from external services (RSS feeds, etc.) into per-user activity stream entities.

    The configuration route does not sufficiently check that the user editing it is the account owner (or a user administrator) leading to an access bypass vulnerability.

    Credits
    Marcus Johansson (marcus_johansson) www.drupal.org/u/marcus_johansson
    References
    To clipboard 

    {
  "affected": [
    {
      "database_specific": {
        "affected_versions": "\u003c2.0.1 || \u003e=2.1.0 \u003c2.1.1"
      },
      "package": {
        "ecosystem": "Packagist:https://packages.drupal.org/8",
        "name": "drupal/actstream"
      },
      "ranges": [
        {
          "database_specific": {
            "constraint": "\u003c2.0.1"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "database_specific": {
            "constraint": "\u003e=2.1.0 \u003c2.1.1"
          },
          "events": [
            {
              "introduced": "2.1.0"
            },
            {
              "fixed": "2.1.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": []
    }
  ],
  "aliases": [
    "CVE-2026-107257"
  ],
  "credits": [
    {
      "contact": [
        "https://www.drupal.org/u/marcus_johansson"
      ],
      "name": "Marcus Johansson (marcus_johansson)"
    }
  ],
  "details": "Actstream (short for Activity Stream) aggregates a user\u0027s activity from external services (RSS feeds, etc.) into per-user activity stream entities.\n\nThe configuration route does not sufficiently check that the user editing it is the account owner (or a user administrator) leading to an access bypass vulnerability.",
  "id": "DRUPAL-CONTRIB-2026-198",
  "modified": "2026-10-07T16:22:05.000Z",
  "published": "2026-10-07T16:22:05.000Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-contrib-2026-198"
    }
  ],
  "schema_version": "1.7.0"
}