Following from #3611657: July 2026 CVEs we need to file CVEs for August.

Issue fork securitydrupalorg-3619146

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

greggles created an issue. See original summary.

greggles opened merge request !30

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented
Status: Active » Needs review

Once again I asked claude to take care of this for me and have reviewed the results.

Here was the prompt:

" Use the data from the API at https://www.drupal.org/api-d7/node.json?type=sa&sort=created&direction=DESC to add information to the sa-data.json file and make it up to date. Be sure to include the URL of the advisory, the project short name, and
assign CWE and CAPEC values to each advisory. Do not modify any older advisory data. Modify the advisory-to-cvejson.php file for any unsupported advisories to the UNSUPPORTED_ADVISORIES array."

Some judgment calls it noted:

Judgment calls where another code is defensible:
- 2026-106 — I followed the timing-attack mechanism (CWE-208/CAPEC-112, the tca precedent). Following the payment-response family instead (CWE-863/CAPEC-87, as 2026-058) would be equally defensible.
- 2026-111 — the root cause is stale cache, not authorization logic. CWE-288/CAPEC-554 describes the outcome; CWE-524-family or CWE-863 are alternatives. sa-core-2025-008's CWE-525 doesn't fit since that's browser cache.
- 2026-105 — CWE-784/565 (reliance on cookies without integrity checking) is more precise, but I matched 2026-015 captcha for consistency.
- 2026-099 — mixes "neutral treated as grant" (863) with "no access check for reusable custom blocks" (862); I chose 863.
- 2026-103 — CAPEC-63 rather than 591/592, since the payload is persisted at the third-party provider rather than on the site.

It took 7 minutes which is less time than it takes me to do this many.

There is a problem where we assigned the same CVE to two advisories for - CVE-2026-81269 assigned to both sa-contrib-2026-108 (datafield) and sa-contrib-2026-111 (disable_login). I plan to upload the datafield one and skip the disable_login one and then try to figure out how to handle it after when its easier to track which CVEs have been used among the ones we've reserved.

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented
Status: Needs review » Fixed

These were all published. I found that we could use CVE-2026-16647 for https://www.drupal.org/sa-contrib-2026-111

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

cmlara’s picture

cmlara
he/him
commented

CVE-2026-76755, CVE-2026-76756 and CVE-2026-76757 should likely be updated to include references to their public disclosures as reported to the Drupal CNA during CVE request.

https://disclosure.cmlara.com/2026/001-Gammu_smsd-RCE/
https://disclosure.cmlara.com/2026/002-Gammu_smsd-TokenDisclosure/
https://disclosure.cmlara.com/2026/003-Gammu_smsd-TimingAttack/

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented
Status: Fixed » Needs work

Yeah, that makes sense to link to those. I guess they are "technical description"?

cmlara’s picture

cmlara
he/him
commented

I would think third-party-advisory and technical-description. The pages are primarily advisory in purpose, however they do include reproduction steps details which starts to become more technical.

003-Gammu_smsd-TimingAttack I believe is only third-party-advisory, it doesn't provide any technical deep dive reproducible steps and only identities the unique flaw (by referencing its code) so that others can identify if they discovery the same flaw in the future.

For others D.O. users who may not be familiar with the CVE Schema here are the definitions:

technical-description: The reference contains in-depth technical information about a vulnerability and its exploitation process, typically in the form of a presentation or whitepaper.

third-party-advisory: Advisory is from an organization that is not the vulnerable product's vendor/publisher/maintainer.

https://cveproject.github.io/cve-schema/schema/docs/#tab-pane_oneOf_i0_c...

cmlara’s picture

cmlara
he/him
commented

Bumping this one.

Also looking at CVE-2026-76759 and CVE-2026-76782 they appear to be missing required information under section 5.1.7 and 5.3.3.3 of CNA rules (failure to identify a vulnerability). Those should be updated a well.

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented

Which CVE gets which of the advisories you wrote?

CVE-2026-76755
CVE-2026-76756
CVE-2026-76757

https://disclosure.cmlara.com/2026/001-Gammu_smsd-RCE/
https://disclosure.cmlara.com/2026/002-Gammu_smsd-TokenDisclosure/
https://disclosure.cmlara.com/2026/003-Gammu_smsd-TimingAttack/

cmlara’s picture

cmlara
he/him
commented

CVE-2026-76755 = https://disclosure.cmlara.com/2026/001-Gammu_smsd-RCE/
CVE-2026-76756 = https://disclosure.cmlara.com/2026/003-Gammu_smsd-TimingAttack/
CVE-2026-76757 = https://disclosure.cmlara.com/2026/002-Gammu_smsd-TokenDisclosure/

(Each article has the CVE ID inside them as well)

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented
Status: Needs work » Fixed

OK, now updated for #12.

I will see about some feedback from the team about points 5.1.7 and 5.3.3.3 before taking action there.

Thanks.

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

cmlara’s picture

cmlara
he/him
commented

Thanks for the updates!.

I will see about some feedback from the team about points 5.1.7 and 5.3.3.3 before taking action there.

Understood, I realize I've also raised similar in #3495457: Unsuported Modules: Establish timeline for publishing of vulnerability info to allow for possible CVE creation in case it is helpful information.