DRUPAL-CONTRIB-2026-307

    Dashboard / Vulnerabilities / DRUPAL-CONTRIB-2026-307

    DRUPAL-CONTRIB-2026-307

    Published: 4 Nov 2026Last Modified: 4 Nov 2026

    Summary:

    Details: This module provides a separate page with a form for users to change their own password, which asks for the current password before accepting a new one. The module doesn't sufficiently verify the current password in some cases. This vulnerability is mitigated by the fact that an attacker must already have access to the victim's authenticated session (for example an unattended browser or a stolen session cookie). It allows that temporary session access to be turned into a persistent account takeover.

    References: https://www.drupal.org/sa-contrib-2026-307

    Affected packages

    Package

    Name: drupal/change_pwd_page

    Purl: pkg:composer/drupal/change_pwd_page?repository_url=https:%2F%2Fpackages.drupal.org%2F8

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -2.0.3

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    DRUPAL-CONTRIB-2026-307 | CVE-DB