{"id":"CVE-2026-114524","kind":"vulnerability","aliases":["CVE-2026-114524"],"related":[],"title":"Drupal Custom Formatters: unsafe privilege definitions allow privilege escalation","description":"Privilege Defined With Unsafe Actions vulnerability in Drupal Custom Formatters allows Privilege Escalation. This issue affects Custom Formatters versions: from 0.0.0 to 4.2.1.","summary":"Drupal Custom Formatters defines privileges with unsafe actions, so a user can gain rights they should not have. An attacker with a low-privilege account could reach permissions reserved for administrators.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["custom-formatters","drupal","package","php"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed `drupal/custom_formatters` version in `composer.lock` or with `composer show drupal/custom_formatters`\n- Confirm whether the module is enabled on the site","fix":"- Move Custom Formatters to a version later than `4.2.1` (the sources list all versions up to `4.2.1` as affected; the exact fixed version is unknown)","status":"open","published_at":"2026-10-30T04:18:10+00:00","first_seen_at":"2026-10-30T04:28:36+00:00","triaged_at":"2026-10-30T04:31:13+00:00","updated_at":"2026-10-30T04:31:13+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-30T04:31:13Z","model":"claude-haiku-5-5","output":{"fix":"- Move Custom Formatters to a version later than `4.2.1` (the sources list all versions up to `4.2.1` as affected; the exact fixed version is unknown)","reach":"internet","title":"Drupal Custom Formatters: unsafe privilege definitions allow privilege escalation","impact":"high","summary":"Drupal Custom Formatters defines privileges with unsafe actions, so a user can gain rights they should not have. An attacker with a low-privilege account could reach permissions reserved for administrators.","audience":"businesses","category":"package","nicknames":[],"who_cares":["drupal","custom-formatters","php"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"low-privilege user gains elevated site permissions","analyst_note":"Confirm the fixed version and the exact privilege affected from the Drupal security advisory; the NVD entry gives only the affected range.","how_to_check":"- Check the installed `drupal/custom_formatters` version in `composer.lock` or with `composer show drupal/custom_formatters`\n- Confirm whether the module is enabled on the site\n- unknown for anything beyond this, the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Drupal sites that have the Custom Formatters module installed at version 4.2.1 or earlier are affected. Sites without this module can skip it. The sources do not say which roles or configurations make the flaw reachable.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00069,"input_tokens":4098,"output_tokens":561,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-114524':12A,15A '-2026':11A,14A '0.0.0':74C '4.2.1':76C 'account':47B 'action':29B,58C 'administr':53B 'affect':69C 'allow':7A,64C 'attack':41B 'could':48B 'custom':2A,17B,23B,62C,70C 'custom-formatt':16B 'cve':10A,13A 'defin':25B,55C 'definit':6A 'drupal':1A,19B,22B,61C 'escal':9A,66C 'formatt':3A,18B,24B,63C,71C 'gain':34B 'issu':68C 'low':45B 'low-privileg':44B 'packag':20B 'permiss':50B 'php':21B 'privileg':5A,8A,26B,46B,54C,65C 'reach':49B 'reserv':51B 'right':35B 'unsaf':4A,28B,57C 'user':32B 'version':72C 'vulner':59C","nicknames":[],"mitigations":[],"who_affected":"Drupal sites that have the Custom Formatters module installed at version 4.2.1 or earlier are affected. Sites without this module can skip it. The sources do not say which roles or configurations make the flaw reachable.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:18:10+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114524","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114524","severity":null,"published_at":"2026-10-30T04:18:10+00:00","modified_at":"2026-10-30T04:18:10+00:00","first_seen_at":"2026-10-30T04:28:36+00:00","fetched_at":"2026-10-30T04:28:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}