[IT-SecNots] [Security-news] Advanced Content Feedback (aka admin_feedback) - Moderately critical - Access bypass / Insecure Direct Object Reference (IDOR) - SA-CONTRIB-2026-052

[security-news AT drupal.org]

View online: https://www.drupal.org/sa-contrib-2026-052

Project: Advanced Content Feedback (aka admin_feedback) [1]
Date: 2026-June-24
Security risk: *Moderately critical* 11 ∕ 25
AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:All [2]
Vulnerability: Access bypass / Insecure Direct Object Reference (IDOR)

Affected versions: <2.8.0
CVE IDs: CVE-2026-13232
Description: 
This module enables you to collect feedback from your site visitors on
content pages, allowing them to optionally attach a free-text comment to
their Yes/No vote.

The module doesn't sufficiently verify authorization over the targeted
feedback record when processing a comment submission.

This vulnerability is mitigated by the fact that an attacker must have a role
with the permission "give feedback". Note: "give feedback" is granted to
anonymous and authenticated by default on install.

Solution: 
Install the latest release:

 * If you use the admin_feedback module for Drupal 8.x, upgrade to
   admin_feedback 8.x-2.8 [3]

The comment endpoint now requires an HMAC-signed token bound to the specific
feedback row (issued only to the visitor who cast that vote), and a comment
may be written only once, preventing both forgery of arbitrary ids and
replay.

Reported By: 
 * Bill Seremetis (bserem) [4]

Fixed By: 
 * Bill Seremetis (bserem) [5]

Coordinated By: 
 * Greg Knaddison (greggles) [6] of the Drupal Security Team
 * Drew Webber (mcdruid) [7] of the Drupal Security Team

Security
issue: 
https://git.drupalcode.org/security/185232-admin_feedback-security/-/work_items/…
[8]
------------------------------------------------------------------------------
Contribution record [9]

[1] https://www.drupal.org/project/admin_feedback
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/admin_feedback/releases/8.x-2.8
[4] https://www.drupal.org/u/bserem
[5] https://www.drupal.org/u/bserem
[6] https://www.drupal.org/u/greggles
[7] https://www.drupal.org/u/mcdruid
[8]  
https://git.drupalcode.org/security/185232-admin_feedback-security/-/work_items/1
[9]  
https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal.org/node/3600919

_______________________________________________
Security-news mailing list -- security-news AT drupal.org
To unsubscribe send an email to security-news-leave AT drupal.org
Unsubscribe at