LDAP / Active Directory Integration security updates, in plain English

LDAP / Active Directory Integration

448 sites report using it · on drupal.org · 1 security update explained here

This module allows people to log into the website using the same username and password they use for their organisation network.

Below is every security update for LDAP / Active Directory Integration that this site has covered, newest first. Each one says who could exploit it, whether it applies to your site, how urgent it is, and what to tell your developer. If your site uses this module and you are not sure which version, that is the first question to ask whoever looks after it.

LDAP / Active Directory Integration

Moderately critical · 448 sites report using it · SA-CONTRIB-2026-115 · on drupal.org · Week of 26 August 2026

Anyone without logging in could send specially crafted text to the search tool used for finding user accounts. This would allow them to discover extra information about the network that they should not normally be able to see. They could not change any information.

Who could do thisAnyone visiting the site. No login needed.
Does it apply to youAny site using this module.
Has it been used in attacksA working example has been published, so assume someone will try.
How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.

Tell your developerUpdate LDAP / Active Directory Integration to 2.2.1.

For developers: what the fix changed

The release diff is linked below. No summary of the fix has been written for this one.

2.2.0 to 2.2.1 0 commits, 0 files.

Full diff, 2.2.0 to 2.2.1

The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.

Get in touch

Tell me who you are, what your organisation does, and what you need. That might be a Drupal site that needs looking after, an upgrade to get done before December, or an agency that needs Drupal cover.

If I can help, I'll say so and suggest a call. If I can't, I'll tell you straight away rather than waste your time.

For context: I work mainly with UK charities, membership bodies and research organisations, and with the agencies that look after their websites. Not recruiters.

Or start smaller and connect with me on LinkedIn. That's where I post what I find digging around in charity and grants data, and where the free tools turn up first.

LDAP / Active Directory Integration

LDAP / Active Directory Integration

Send me your Drupal site's address.

Get in touch

Links

Reference