Live › vulnerability › CVE-2026-114524
Drupal Custom Formatters defines privileges with unsafe actions, so a user can gain rights they should not have. An attacker with a low-privilege account could reach permissions reserved for administrators.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Drupal sites that have the Custom Formatters module installed at version 4.2.1 or earlier are affected. Sites without this module can skip it. The sources do not say which roles or configurations make the flaw reachable.
No product ranges from the sources yet.
drupal/custom_formatters version in composer.lock or with composer show drupal/custom_formatters4.2.1 (the sources list all versions up to 4.2.1 as affected; the exact fixed version is unknown)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Privilege Defined With Unsafe Actions vulnerability in Drupal Custom Formatters allows Privilege Escalation. This issue affects Custom Formatters versions: from 0.0.0 to 4.2.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-114524")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.