Nothing says "check your composer.json" quite like waking up to sixteen security advisories landing in a single batch. Drupal's security team just did exactly that, and if you haven't audited your contributed modules lately, today's the day the universe is politely insisting.

Sixteen Advisories, Five of Them Critical

The Drupal Security Team published a September 2 disclosure batch covering 16 contributed-project advisories across 14 modules — five rated Critical, eleven Moderately Critical. No Drupal core issues were involved; this is entirely in the contrib ecosystem, the thousands of community-built modules sites layer on top of core.

The critical bugs read like a greatest-hits list of ways to lose control of a site: the Unpublished Node Permissions module (CVE-2026-84920) can leak content it's supposed to hide, Jsonapi Role Access (CVE-2026-84917) fails to enforce access controls under certain XMLHttpRequest-style requests, and the Email/SMS/OTP Verification module carries both an unauthenticated reflected XSS flaw and a separate account-takeover bug from insufficient input validation. Moderately critical fixes also went out for Advanced Search, Webform Submissions Delete, PhotoSwipe, Media Library Importer, and several others.

The Module You Forgot You Installed Is the One That Bites

Drupal core has a well-earned reputation for tight security, but contrib modules are built by a much wider, much less resourced pool of maintainers — and a site with 20 or 30 modules installed has 20 or 30 different people's code deciding who can see what. Account takeover and access bypass bugs are exactly the kind of thing that turn "just a login form" into "please explain this breach to our board."

The advisories that should worry you most aren't the flashy XSS ones — they're the quiet access-bypass bugs, because those don't announce themselves. Nobody gets a popup that says "unauthorized user viewed your private content." You just find out later, if you find out at all.

Sixteen advisories in a day isn't a crisis, it's Tuesday for an active open-source project — but only if someone's actually running composer update on a regular cadence.

If auditing your site's module inventory against these advisories sounds like a job you'd rather hand off, that's exactly the kind of Drupal maintenance work we do for clients every week.

Source: TheDropTimes