Project: 
Download Count
Project machine name: 
download_count
Date: 
2026-November-11
Security risk: 
Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default
Vulnerability: 
Access bypass
Affected versions: 
<2.2.5 || >=3.0.0 <3.0.2
CVE IDs: 
CVE-2026-126740
Description: 

This module tracks file downloads for private files and provides reports about them.

The module provides the permissions that are never actually checked. A user with only the View download counts permission could export the download log and delete all download records.

This vulnerability is mitigated by the fact that an attacker must have an account with the View download counts permission.

Solution: 

Install the latest version:

After the update, grant the permissions reset download counts and export download counts only to the roles that need them.

Reported By: 
Fixed By: 
Coordinated By: