Project: 
Domain
Project machine name: 
domain
Date: 
2026-October-21
Security risk: 
Moderately critical 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon
Vulnerability: 
Access bypass
Affected versions: 
>=3.0.0 <3.0.2
CVE IDs: 
CVE-2026-114540
Description: 

This module enables you to share users, content and configuration across a group of domains from a single Drupal installation. Its Domain Access submodule controls which domains a user may edit content on, and has an optional setting to grant user access per content type.

The module doesn't sufficiently check which domains a user is assigned to when the per-content-type grant setting is enabled.

This vulnerability is mitigated by the fact that the per-content-type grants setting must be enabled (it is off by default), and an attacker must have a role with the permission "Edit any content on assigned domains" or "Delete any content on assigned domains" together with a per-content-type permission such as "Article: Edit any content on assigned domains", and must be assigned to at least one domain.

Solution: 

Install the latest version:

The 2.0.x branch of the module is not affected by this vulnerability.

Reported By: 
Fixed By: 
Coordinated By: