The 2026 Drupal Business Survey is open. Your response will help shape the future of the Drupal business ecosystem.Drupal requires the current password to change the e-mail address or password so that an attacker who can perform actions on behalf of a victim user (e.g., using XSS) cannot take over the user's account by changing the e-mail address or password.
However, not requiring the current password for forced password changes undoes this security protection under certain circumstances. For instance, with Password Policy an administrator can force a password change on themselves, which then allows them to change the password or e-mail address without providing the current password.
The fix is to simply require the current password for forced password changes, unless a valid password reset link is being used.
This issue was originally reported as a security issue by Fabio.E.Questionmark, and after discussion with the security team and other maintainers it was decided that this issue could be fixed publicly.
| Comment | File | Size | Author |
|---|---|---|---|
| #2 | password_policy-7.x-1.x-reenable_current_password_field.patch | 4.42 KB | aohrvetpv |
Comments
Comment #1
aohrvetpv commentedComment #2
aohrvetpv commentedPrimary change in patch is to remove the lines that remove the current password field.
Some further changes were then required to get tests to pass:
1. Current password is provided where needed.
2. The current password field is supposed to be removed when the user has used a one-time login link. However, the field could reappear if the user is forced to change their password and they try to browse to another page (causing a redirect back to the user-edit page). The patch improves the persisting of the password reset token across requests so this should not happen.
Comment #3
aohrvetpv commentedComment #5
aohrvetpv commentedNot relevant to 6.x-1.x as D6 does not require current password for password or e-mail address changes.
Comment #7
hanoiiHmm,
This was unfortunate for us. We use the features of this module to both expire and reset passwords, and we use it even for users we create from external sources. These users does not provide a password initially but we do redirect them to the drupal site logged in, and with the use of this module feature so they can choose one at that point. Showing the current password field is very confusing then.
I wonder if this could have been made configurable?
I will be moving what this patch removed to a custom module, but I am raising this for discussion.
Comment #8
aohrvetpv commentedhanoii, the current password field is not shown when using a one-time login link (i.e., a password reset link), even if a password change is forced. Would it work in your use case to use a one-time login link to log the user in the first time?