Peter Brady, Drupal developer and private AI consultant

Drupal security updates, in plain English

Week of 4 March 2026

Drupal publishes security updates on Wednesdays. This week there were 5, all for modules. Between them they carry 8 security fixes, because a module can fix several bugs in one update: OpenID Connect / OAuth client fixed 3 and File Access Fix (deprecated) fixed 2.

None for Drupal core, so nothing here applies to every site.

Each card says what the module does, what went wrong, who could do it, whether it applies to you, how urgent it is, and the one line to send to your developer. Worst rated first, and most used first within a rating.

New here? How Drupal security updates work explains who publishes these, why they matter and what the ratings mean. Earlier weeks and a search by module are on the main page.

Critical: 1 update

Cyber Essentials expects a fix within 14 days. Do it this week.

AJAX Dashboard

Critical · 6 sites report using it · SA-CONTRIB-2026-022 · on drupal.org

This module lets developers build interactive control panels for different pieces of content.

The system does not check if a person has the right to view the settings page. Anyone visiting the site could turn the control panels on or off and see private information. They could not edit the actual layout of the panels.

  • Who could do thisAnyone visiting the site. No login needed.
  • Does it apply to youThis applies when the extra feature for attaching control panels to pieces of content is turned on.
  • Has it been used in attacksNo sign of it.
  • How urgentDrupal rates this critical. Cyber Essentials expects a fix within 14 days. Do it this week.

Tell your developerUpdate AJAX Dashboard to 3.1.0.

For developers: what the fix changed

Changes the access requirement for the settings route in ajax_dashboard_entity_dashboard.routing.yml from a blanket true to requiring the administer ajax_dashboard_entity_dashboard permission.

Also in this release Fixed a typo in the module info file.

3.0.9 to 3.1.0 2 commits, 2 files.

  • modules/ajax_dashboard_entity_dashboard/ajax_dashboard_entity_dashboard.info.yml +1 −1
  • modules/ajax_dashboard_entity_dashboard/ajax_dashboard_entity_dashboard.routing.yml +1 −1 fix

Full diff, 3.0.9 to 3.1.0

The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.

Moderately critical: 4 updates

Include in your next routine update, within the month.

OpenID Connect / OAuth client

Moderately critical · 33,019 sites report using it · 3 security fixes

This module allows people to log in to the website using an external account provider.

3 security fixes in one update. OpenID Connect / OAuth client fixed 3 separate security bugs this week: 2 access bypass, 1 server side request forgery. One update covers all of them. The most serious, SA-CONTRIB-2026-026, is explained here and the full list is at the end of the card.

A person who is blocked from logging in due to a server error might stay logged in at the external provider. Someone else using the same shared computer could then access the website as that person and see their private information. They could not change any information on the site.

  • Who could do thisOnly someone with a login on your site.
  • Does it apply to youAny site using this module.
  • Has it been used in attacksNo sign of it.
  • How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.

Tell your developerUpdate OpenID Connect / OAuth client to 8.x-1.5.

For developers: what the fix changed

This release carries 3 security fixes. The summary below is for SA-CONTRIB-2026-026, the most serious of them.

The fix adds support for the `prompt` parameter in OpenID Connect authentication requests, defaulting to `login` in `src/Plugin/OpenIDConnectClientBase.php` to ensure users are explicitly prompted to authenticate by the Identity Provider. It also adds an update hook and requirements check in `openid_connect.install` to warn administrators if the prompt is misconfigured.

Also in this release The release also adds entity validation during user creation, improves profile picture handling, fixes a fatal error in the user login form, and adds a GitLab CI configuration and project logo.

8.x-1.4 to 8.x-1.5 6 commits, 8 files.

  • .gitlab-ci.yml +60 −0
  • config/schema/openid_connect.schema.yml +36 −0 fix
  • logo.png +0 −0
  • openid_connect.install +51 −0 fix
  • openid_connect.module +7 −4
  • openid_connect.services.yml +1 −1
  • src/OpenIDConnect.php +170 −17
  • src/Plugin/OpenIDConnectClientBase.php +31 −1 fix

Full diff, 8.x-1.4 to 8.x-1.5

The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.

All 3 security bugs this update fixes, worst first. Each link is the drupal.org notice for that one.

Google Analytics GA4

Moderately critical · 2,151 sites report using it · SA-CONTRIB-2026-024 · on drupal.org

This module adds tracking code to the website to provide insights into visitor behaviour.

The system does not clean up custom attributes added to the tracking code. A person with the right to change these settings could add malicious scripts that run on every page. They could see private information and change data on the website.

  • Who could do thisOnly someone with an administrator login.
  • Does it apply to youThis applies when a person has the access right to configure the tracking settings.
  • Has it been used in attacksNo sign of it.
  • How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.

Tell your developerUpdate Google Analytics GA4 to 1.1.14.

For developers: what the fix changed

The fix adds strict validation to the scripts_custom_attributes field in src/Form/Ga4GoogleAnalyticsSettings.php using a regex allowlist and filters the attributes in ga4_google_analytics_page_attachments within ga4_google_analytics.module to ensure only safe attributes are included.

1.1.13 to 1.1.14 1 commit, 2 files.

  • ga4_google_analytics.module +15 −0 fix
  • src/Form/Ga4GoogleAnalyticsSettings.php +51 −0 fix

Full diff, 1.1.13 to 1.1.14

The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.

Calculation Fields

Moderately critical · 140 sites report using it · SA-CONTRIB-2026-023 · on drupal.org

This module adds a feature to web forms that can calculate mathematical expressions.

The system does not properly check the information typed into the form. A person could enter malicious scripts to see private information or change data on the website.

  • Who could do thisAnyone visiting the site. No login needed.
  • Does it apply to youAny site using this module.
  • Has it been used in attacksNo sign of it.
  • How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.

Tell your developerUpdate Calculation Fields to 1.0.4.

For developers: what the fix changed

Adds HTML escaping to calculation results and enforces numeric validation on inputs in `js/calculation-fields.js` and `FormCalculationMarkupElement.php` to prevent XSS.

Also in this release Removed packaging metadata from info files, updated README documentation, and improved handling of zero values in expressions.

1.0.3 to 1.0.4 5 commits, 16 files including 1 test.

  • README.md +17 −2
  • calculation_fields.info.yml +0 −6
  • calculation_fields.module +1 −1
  • js/calculation-fields.js +69 −13 fix
  • modules/calculation_fields_example/calculation_fields_example.info.yml +0 −5
  • modules/calculation_fields_example/calculation_fields_example.module +1 −1
  • modules/webform_calculation_fields/README.md +8 −3
  • modules/webform_calculation_fields/modules/webform_calculation_fields_examples/webform_calculation_fields_examples.info.yml +0 −5
  • modules/webform_calculation_fields/src/Plugin/WebformElement/WebformCalculationNumber.php +0 −1
  • modules/webform_calculation_fields/webform_calculation_fields.info.yml +0 −5
  • src/CalculationFieldsTrait.php +1 −2
  • src/Element/FormCalculationElement.php +3 −5

Full diff, 1.0.3 to 1.0.4

The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.

File Access Fix (deprecated)

Moderately critical · 68 sites report using it · 2 security fixes

This module moves files into private storage based on the access rights of the piece of content they belong to.

2 security fixes in one update. File Access Fix (deprecated) fixed 2 separate security bugs this week: 2 access bypass. One update covers all of them. The most serious, SA-CONTRIB-2026-021, is explained here and the full list is at the end of the card.

The system sometimes fails to apply the correct privacy rules when a piece of content is saved for the first time. Anyone visiting the site could view files that should be kept private. They could not change or delete the files.

  • Who could do thisAnyone visiting the site. No login needed.
  • Does it apply to youAny site using this module.
  • Has it been used in attacksNo sign of it.
  • How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.

Tell your developerUpdate File Access Fix (deprecated) to 8.x-1.2.

For developers: what the fix changed

This release carries 2 security fixes. The summary below is for SA-CONTRIB-2026-021, the most serious of them.

The fix updates src/FileAccessFixEntityHooks.php to pass the currently saved entity to anyFileUsageHasAnonAccess and use it for access checks, and adds a hookDownloadAllowed check to ensure file download access is properly validated before marking a file as public.

8.x-1.1 to 8.x-1.2 1 commit, 1 file.

  • src/FileAccessFixEntityHooks.php +49 −5 fix

Full diff, 8.x-1.1 to 8.x-1.2

The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.

All 2 security bugs this update fixes, worst first. Each link is the drupal.org notice for that one.

Not sure what your site is running?

Send me your Drupal site's address.

I'll tell you what I can see from outside, what the Drupal 10 end of life on 9 December means for it, and what it would cost to have me keep it patched. There's no charge for that and no obligation. peter@peterbrady.co.uk

Compiled 10 October 2026 as part of the archive back to January 2026, from the advisories published by the Drupal security team on drupal.org. The facts on each card are theirs. The plain English is mine, with help from a language model. In the archive the cards rated critical or above were read before publishing and the rest were checked by sampling. Install counts are today's, not the count on the day of the advisory.

Get in touch

Tell me who you are, what your organisation does, and what you need. That might be a Drupal site that needs looking after, an upgrade to get done before December, or an agency that needs Drupal cover.

If I can help, I'll say so and suggest a call. If I can't, I'll tell you straight away rather than waste your time.

peter@peterbrady.co.uk

For context: I work mainly with UK charities, membership bodies and research organisations, and with the agencies that look after their websites. Not recruiters.

Or start smaller and connect with me on LinkedIn. That's where I post what I find digging around in charity and grants data, and where the free tools turn up first.

Peter Brady, Drupal developer and private AI consultant

PNB Technologies Limited
55 Yew Tree Road, Ormskirk
Lancashire, L39 1NT, United Kingdom

Company Reg: 07166600
VAT Reg: GB986726850

© 2026 Peter Brady. All rights reserved.

Connect on LinkedIn

Links

Reference