Every newsroom and marketing team has the same nightmare: the embargoed announcement goes live at 9 p.m. instead of 9 a.m. tomorrow. Drupal's Scheduler module exists to prevent exactly that, which makes this week's security advisory feel a bit like finding out the smoke detector can start fires.
Who gets to touch the clock
On November 4, the Drupal Security Team published SA-CONTRIB-2026-306 (CVE-2026-122075), rating it moderately critical at 13 out of 25. Scheduler didn't properly check whether a user had permission to change publication or unpublication dates. That could let someone publish content ahead of schedule, or make it disappear earlier or later than planned.
There are real limits on who can pull this off. The attacker already needs edit access to the content, and the content has to be editable through a web services API such as JSON:API or REST. The fix is in Scheduler 8.x-1.7, 2.2.3 and 2.3.1, and the 2.1.x branch is no longer supported, so anyone still on it should move to 2.2.3 or 2.3.1. The advisory offers no workaround short of upgrading.
Headless sites, take note
A moderately critical bug that requires an existing editor account won't make headlines. It still matters a lot to organizations that use Scheduler for embargoes, earnings releases, product launches or legal notices, where "published three hours early" is the whole incident. The API condition is the interesting part. Decoupled and headless Drupal builds, plus integrations that push content in from other systems, are exactly the setups where the permission check went missing.
The timing adds a second reason to look at your sites now. Drupal's release schedule lists Drupal 12.0.0-rc1 and 11.5.0-rc1 for the week of November 9, with final releases the week of December 7. Drupal 10 reaches end of life on December 9, the same week. If a site is still on Drupal 10, a contrib advisory like this one is a preview of what patching looks like once the security team stops covering your core version.
Update Scheduler today, then put the Drupal 10 upgrade on the calendar using a publish date that only you control.
Whether you need a quick contrib patch on a headless build or a full move off Drupal 10 before the December deadline, talk to our Drupal team and we'll help you plan it.