[IT-SecNots] [Security-news] ECA: Event - Condition - Action - Less critical - Information disclosure - SA-CONTRIB-2026-074

[security-news AT drupal.org]

View online: https://www.drupal.org/sa-contrib-2026-074

Project: ECA: Event - Condition - Action [1]
Date: 2026-July-08
Security risk: *Less critical* 8 ∕ 25
AC:Complex/A:User/CI:Some/II:None/E:Theoretical/TD:Uncommon [2]
Vulnerability: Information disclosure

Affected versions: <2.1.20 || >=3.0.0 <3.0.12 || >=3.1.0 <3.1.4
CVE IDs: CVE-2026-15083
Description: 
The Events, Conditions, Actions (ECA) module's Render submodule enables you
to build render arrays and render inline Twig templates as part of no-code
ECA models.

The module doesn't sufficiently sanitize template code when rendering, which
can lead to information disclosure.

This vulnerability is mitigated by the fact that a site must be running an
ECA model that uses the "Render: Twig" action on a data flow.

Solution: 
Install the latest version:

 * If you use the ECA 3.1 for Drupal 10.x or 11.x, upgrade to ECA 3.1.4 [3]
 * If you use the ECA 3.0 for Drupal 10.x or 11.x, upgrade to ECA 3.0.12 [4]
 * If you use the ECA 1.2 for Drupal 10.x or 11.x, upgrade to ECA 2.1.20 [5]

Reported By: 
 * Changhai Qi (qichanghai) [6]

Fixed By: 
 * Jürgen Haas (jurgenhaas) [7]

Coordinated By: 
 * Neil Drumm (drumm) [8] of the Drupal Security Team
 * Greg Knaddison (greggles) [9] of the Drupal Security Team
 * Dave Long (longwave) [10] of the Drupal Security Team

Security
issue: https://git.drupalcode.org/security/3590327-eca-security/-/work_items/1
[11]
------------------------------------------------------------------------------
Contribution record [12]

[1] https://www.drupal.org/project/eca
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/node/3609312
[4] https://www.drupal.org/node/3609311
[5] https://www.drupal.org/node/3609310
[6] https://www.drupal.org/u/qichanghai
[7] https://www.drupal.org/u/jurgenhaas
[8] https://www.drupal.org/u/drumm
[9] https://www.drupal.org/u/greggles
[10] https://www.drupal.org/u/longwave
[11] https://git.drupalcode.org/security/3590327-eca-security/-/work_items/1
[12]  
https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal.org/node/3608488

_______________________________________________
Security-news mailing list -- security-news AT drupal.org
To unsubscribe send an email to security-news-leave AT drupal.org
Unsubscribe at