Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    Related vulnerabilities

    DRUPAL-CONTRIB-2026-190 (CVE-2026-96386)

    Vulnerability from drupal – Published: 2026-09-23 17:23 – Updated: 2026-09-23 17:27 – Source website
    VLAI
    Details

    This module enables you to personalize content for anonymous and authenticated users by showing different blocks to visitors based on client-side conditions.

    The Smart Content Block submodule doesn't sufficiently check block access when it renders the blocks of a "Display Blocks" reaction through the module's AJAX endpoint.

    This vulnerability is mitigated by the fact that a site must have placed a block whose access is restricted to certain users inside a Display Blocks reaction. Sites that only use Views blocks in reactions are not affected, because Views re-checks access when the view is executed.

    Credits
    Tin Nguyen Huu (s4m0y3d) www.drupal.org/u/s4m0y3d
    References
    To clipboard 

    {
  "affected": [
    {
      "database_specific": {
        "affected_versions": "\u003c3.2.1"
      },
      "package": {
        "ecosystem": "Packagist:https://packages.drupal.org/8",
        "name": "drupal/smart_content"
      },
      "ranges": [
        {
          "database_specific": {
            "constraint": "\u003c3.2.1"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": []
    }
  ],
  "aliases": [
    "CVE-2026-96386"
  ],
  "credits": [
    {
      "contact": [
        "https://www.drupal.org/u/s4m0y3d"
      ],
      "name": "Tin Nguyen Huu (s4m0y3d)"
    }
  ],
  "details": "This module enables you to personalize content for anonymous and authenticated users by showing different blocks to visitors based on client-side conditions.\n\nThe Smart Content Block submodule doesn\u0027t sufficiently check block access when it renders the blocks of a \"Display Blocks\" reaction through the module\u0027s AJAX endpoint.\n\nThis vulnerability is mitigated by the fact that a site must have placed a block whose access is restricted to certain users inside a Display Blocks reaction. Sites that only use Views blocks in reactions are not affected, because Views re-checks access when the view is executed.",
  "id": "DRUPAL-CONTRIB-2026-190",
  "modified": "2026-09-23T17:27:26.000Z",
  "published": "2026-09-23T17:23:37.000Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-contrib-2026-190"
    }
  ],
  "schema_version": "1.7.0"
}