Project: 
Texts: key-based strings and translations
Project machine name: 
texts
Date: 
2026-November-11
Security risk: 
Moderately critical 11 ∕ 25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:All
Vulnerability: 
Cross-site request forgery
Affected versions: 
>=1.0.13 <1.0.17
CVE IDs: 
CVE-2026-126728
Description: 

The Texts module provides key-based strings and translations for Drupal and tools for managing them.

The module does not sufficiently protect an action to restore a duplicate translation. A crafted request can cause a user with access to the translation overview to overwrite an existing translation and delete the duplicate, even if that user cannot edit or delete translations.

This vulnerability is mitigated by the fact that an attacker must first create a suitable duplicate translation and induce a user with access to the translation overview to open the crafted request.

Solution: 

Install the latest version:

  • If you use Texts 1.0.13 through 1.0.16, upgrade to Texts 1.0.17.
  • Versions prior to 1.0.13 are not affected.
Reported By: 
Fixed By: 
Coordinated By: