Vulnerability DRUPAL-CONTRIB-2026-331
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
13 hours ago
November 11, 2026 at 05:58 PM UTC
No summary available
<2.2.5, >=3.0.0 <3.0.2
<2.2.5, >=3.0.0 <3.0.2
Details
This module tracks file downloads for private files and provides reports about them.
The module provides the permissions that are never actually checked. A user with only the View download counts permission could export the download log and delete all download records.
This vulnerability is mitigated by the fact that an attacker must have an account with the View download counts permission.
References
Impacted packages
Timeline
Published
13 hours ago
November 11, 2026 at 05:58 PM UTC
Last Modified
12 hours ago
November 11, 2026 at 06:45 PM UTC