CVE-2026-114530 Drupal CVE debrief

Who should care

Drupal site administrators and security teams should assess exposure and apply patches for the Dopup module, particularly for sites using Webforms.

Why it matters

The Dopup module's insufficient entity access checking may expose titles of private Webforms, requiring defenders to verify exposure, apply patches, and review Webform configurations.

• Defenders should verify if private Webform titles are exposed due to insufficient entity access checking.
• Site administrators may need to review and update Webform configurations to prevent unintended exposure.
• Applying patches for the Dopup module is crucial to prevent potential information disclosure.

Technical summary

The Dopup module for Drupal provides functionality for selecting and working with Webforms. However, it does not perform sufficient entity access checking in some cases, which may expose the titles of private Webforms. This vulnerability affects versions less than 1.0.7 of the Dopup module.

Defensive priority

Defenders should prioritize verifying exposure and applying patches for the Dopup module, particularly for sites using Webforms.

Recommended defensive actions

• Verify if the Dopup module is installed and in use.
• Check the current version of the Dopup module and update to 1.0.7 or later if necessary.
• Review Webform configurations for potential exposure of private titles.

Evidence notes

The Dopup module's insufficient entity access checking may expose private Webform titles. Affected versions are less than 1.0.7; version 1.0.7 is fixed.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.