[IT-SecNots] [Security-news] Mailer Plus Log - Moderately critical - Access bypass - SA-CONTRIB-2026-128

[security-news AT drupal.org]

View online: https://www.drupal.org/sa-contrib-2026-128

Project: Mailer Plus Log [1]
Date: 2026-September-02
Security risk: *Moderately critical* 12 ∕ 25
AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Default [2]
Vulnerability: Access bypass

Affected versions: <1.2.7
CVE IDs: CVE-2026-16648
Description: 
This module enables you to log the emails sent by Mailer Plus as content
entities, so they can be reviewed at Reports > Mail log.

The module doesn't sufficiently redact the content of the emails it logs.
Account related emails are stored with their one-time login links intact, so
any user who can view the log can obtain a one-time login link for any
account, including user 1, and use it to log in as that account.

This vulnerability is mitigated by the fact that an attacker must have a role
with the permission View Drupal Symfony Mailer log entries, which in earlier
releases was not marked as a restricted permission.

Solution: 
Install the latest version:

 * If you use the Mailer Plus Log module (previously known as Symfony Mailer
   Log), upgrade to Mailer Plus Log 1.2.7 [3]
 * After updating, run database updates so that the email bodies already
   stored in the log are redacted.
 * Review who should have the View Drupal Symfony Mailer log entries
   permission, and whether your site sends out custom sensitive emails that
   would need to opt in to the redaction logic.

Reported By: 
 * Sven Decabooter (svendecabooter) [4]

Fixed By: 
 * Mohit Aghera (mohit_aghera) [5] provisional member of the Drupal Security
   Team
 * Sven Decabooter (svendecabooter) [6]

Coordinated By: 
 * Swan Kalata (akalata) [7] of the Drupal Security Team
 * Greg Knaddison (greggles) [8] of the Drupal Security Team
 * Mohit Aghera (mohit_aghera) [9]

------------------------------------------------------------------------------
Contribution record [10]

[1] https://www.drupal.org/project/symfony_mailer_log
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/symfony_mailer_log/releases/1.2.7
[4] https://www.drupal.org/u/svendecabooter
[5] https://www.drupal.org/u/mohit_aghera
[6] https://www.drupal.org/u/svendecabooter
[7] https://www.drupal.org/u/akalata
[8] https://www.drupal.org/u/greggles
[9] https://www.drupal.org/u/mohit_aghera
[10]  
https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal.org/node/3619706

_______________________________________________
Security-news mailing list -- security-news AT drupal.org
To unsubscribe send an email to security-news-leave AT drupal.org
Unsubscribe at