Quick Tabs security updates, in plain English

Quick Tabs

24,791 sites report using it · on drupal.org · 1 security update explained here

This module lets a website display different pieces of content inside clickable tabs.

Below is every security update for Quick Tabs that this site has covered, newest first. Each one says who could exploit it, whether it applies to your site, how urgent it is, and what to tell your developer. If your site uses this module and you are not sure which version, that is the first question to ask whoever looks after it.

Quick Tabs

Moderately critical · 24,791 sites report using it · SA-CONTRIB-2026-099 · on drupal.org · Week of 12 August 2026

A visitor could see hidden or unpublished pieces of content if an administrator had previously added them to a tab. They could view these specific items without the correct access rights. They could not change or delete any of this information.

Who could do thisAnyone visiting the site. No login needed.
Does it apply to youAny site using this module.
Has it been used in attacksNo sign of it.
How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.

Tell your developerUpdate Quick Tabs to 4.3.1.

For developers: what the fix changed

The fix updates `src/Plugin/TabType/BlockContent.php` and `src/Plugin/TabType/NodeContent.php` to strictly require an allowed access result (`isAllowed()`) rather than just checking for a forbidden result (`isForbidden()`) when rendering block plugins and node tabs. It also adds an explicit access check for reusable custom blocks in `BlockContent.php`.

Also in this release The release also replaces the js_cookie dependency with localStorage for tab memory, fixes an issue where inner tab titles were wiped during AJAX loads, and improves cacheability metadata handling.

4.3.0 to 4.3.1 3 commits, 31 files including 17 tests.

composer.json +1 −2
js/quicktabs.js +12 −15
quicktabs.info.yml +0 −1
quicktabs.install +5 −6
quicktabs.libraries.yml +0 −1
src/Controller/QuickTabsController.php +27 −5
src/Entity/QuickTabsInstance.php +1 −1
src/Form/QuickTabsInstanceEditForm.php +1 −1
src/Plugin/TabRenderer/QuickTabs.php +39 −26
src/Plugin/TabType/BlockContent.php +34 −8 fix
src/Plugin/TabType/NodeContent.php +17 −3 fix
src/Plugin/TabType/QtabsContent.php +17 −1

Full diff, 4.3.0 to 4.3.1

The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.

Get in touch

Tell me who you are, what your organisation does, and what you need. That might be a Drupal site that needs looking after, an upgrade to get done before December, or an agency that needs Drupal cover.

If I can help, I'll say so and suggest a call. If I can't, I'll tell you straight away rather than waste your time.

For context: I work mainly with UK charities, membership bodies and research organisations, and with the agencies that look after their websites. Not recruiters.

Or start smaller and connect with me on LinkedIn. That's where I post what I find digging around in charity and grants data, and where the free tools turn up first.

Quick Tabs

Quick Tabs

Send me your Drupal site's address.

Get in touch

Links

Reference