Nobody wants a note home from the Drupal Security Team, but five contributed modules got one anyway this week. The good news: no one panicked, patches shipped fast, and the whole thing is a pretty solid advertisement for why Drupal's security process is the adult in the room.
Four Access Bypasses and One SSRF, All in a Day
On August 12, 2026, the Drupal Security Team published five Moderately Critical advisories for contributed projects. Four are access bypass issues — Commerce PayPal (CVE-2026-73475), Diff (CVE-2026-73478), External Authentication, and Quick Tabs — and one, Entity Share Websub, is a server-side request forgery (SSRF) vulnerability caused by insufficiently validated input.
The Commerce PayPal bug is the one to watch if you run e-commerce: sites using the Payflow Link gateway could let an attacker mark an order as paid when no payment ever happened. Diff's flaw lets someone view revision differences on non-node entities they shouldn't have access to, though an attacker still needs some baseline permissions to exploit it. Fixes are already out — Commerce PayPal 2.1.3 or 8.x-1.12, Diff 2.0.1 or 2.1.1 — with the rest following the same "upgrade now" script.
Boring News Is Good News, Actually
Here's the thing that makes this a non-event instead of a headline disaster: every one of these was caught, disclosed responsibly, and patched before attackers had a public roadmap to exploit them. That's the entire point of a coordinated disclosure process, and Drupal's contrib ecosystem runs it like clockwork.
The real risk isn't the advisory — it's the site that never applies it. A CVE with a fix available for weeks is functionally a to-do list item, not a threat, right up until someone forgets to check their update report. And with e-commerce sites in the mix here, "forgot to update" can turn into "gave away free stuff to strangers on the internet."
Five advisories, five fixes, zero drama — as long as somebody's actually running the updates.
If keeping tabs on contrib module advisories isn't your idea of a fun Tuesday, that's literally what WTK's Drupal maintenance retainers are for — let's talk about getting your site off the "hope nothing happens" plan.
Source: The Drop Times