CVE-2026-114572 Drupal CVE debrief

Who should care

Drupal site administrators and security teams should assess exposure and prioritize updates, especially if the Domain Login Restrict module is used and the 'Enable restriction' setting is enabled.

Why it matters

Defenders should care about CVE-2026-114572 because it allows attackers with valid user accounts to bypass domain login restrictions in Drupal, potentially leading to unauthorized access. Site administrators and security teams should assess exposure, prioritize updates to version 1.5.0 or higher, review user permissions, and monitor login attempts. Evidence is limited to official CVE and NVD records, and details about exploitation or specific impacts are not provided.

• Potential unauthorized access to restricted domains
• Need to verify and update the Domain Login Restrict module
• Monitoring of login attempts and user activity required
• Review of user permissions necessary

Technical summary

The Domain Login Restrict module for Drupal does not sufficiently enforce login restrictions when users log in through methods other than the standard login form. An attacker with a valid user account can exploit this to access domains they are not assigned to, if the 'Enable restriction' setting is enabled. This issue does not affect users with the 'Login to any domain' permission. The vulnerability is confirmed by the Drupal security team and is described in the official CVE record and NVD vulnerability detail pages. However, details about exploitation or specific attacks are not provided in the source corpus. To address this, defenders should prioritize verifying and updating the Domain Login Restrict module

Defensive priority

Defenders should prioritize verifying and updating the Domain Login Restrict module to version 1.5.0 or higher, reviewing user permissions, and monitoring login attempts.

Recommended defensive actions

• Update the Domain Login Restrict module to version 1.5.0 or higher
• Review and restrict user permissions, especially the 'Login to any domain' permission
• Monitor login attempts and user activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is confirmed by the Drupal security team and is described in the official CVE record and NVD vulnerability detail pages. However, details about exploitation or specific attacks are not provided in the source corpus.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.