Vulnerability DRUPAL-CONTRIB-2026-198
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
11 hours ago
October 07, 2026 at 04:22 PM UTC
No summary available
Details
Actstream (short for Activity Stream) aggregates a user's activity from external services (RSS feeds, etc.) into per-user activity stream entities.
The configuration route does not sufficiently check that the user editing it is the account owner (or a user administrator) leading to an access bypass vulnerability.
References
Impacted packages
Timeline
Published
11 hours ago
October 07, 2026 at 04:22 PM UTC
Last Modified
7 hours ago
October 07, 2026 at 08:15 PM UTC