Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
CVE-2026-122083: Drupal Adobe Analytics module can let attackers inject code
CVE-2026-122083 · published today
Summary
The Adobe Analytics add‑on for Drupal does not properly restrict who can use its advanced features, allowing a user with content‑editing rights to insert malicious scripts. This could cause unwanted code to run in visitors' browsers, potentially stealing data or altering page behavior. Limit the module's use to trusted users and apply any available updates or patches to tighten access controls.
What to do
- Update drupal drupal/adobe_analytics to version 1.1.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Packagist:https://packages.drupal.org/8 | drupal | drupal/adobe_analytics |
< 1.1.0 Fix: upgrade to 1.1.0
|
Original advisory text
This module integrates the Site Catalyst or AdobeAnalytics software into a Drupal site.
The module does not sufficiently provide access controls for advanced functionality, which exposes a cross-s...
This module integrates the Site Catalyst or AdobeAnalytics software into a Drupal site.
The module does not sufficiently provide access controls for advanced functionality, which exposes a cross-site scripting (XSS) vulnerability.
This vulnerability is mitigated by the fact that an attacker must have permission to add or edit content that is configured to use the module's functionality.
The module does not sufficiently provide access controls for advanced functionality, which exposes a cross-site scripting (XSS) vulnerability.
This vulnerability is mitigated by the fact that an attacker must have permission to add or edit content that is configured to use the module's functionality.
References
Timeline
Published4 Nov 2026
Updated4 Nov 2026
First seen4 Nov 2026
Track software like this
Free during beta