CVE-2026-122077 Drupal CVE debrief

Who should care

Drupal administrators and users who have the Allowed Languages module installed should assess their exposure and verify if their installation is affected by this vulnerability. They should prioritize updating to version 2.0.3 or later of the Allowed Languages module and review user access and content creation permissions to prevent potential exploitation.

Why it matters

The Allowed Languages module for Drupal has a vulnerability that allows users to create content in disallowed languages, potentially leading to security issues. Defenders should verify exposure, assess impact, and prioritize remediation.

• Defenders need to verify if their Drupal installation uses the Allowed Languages module and assess the impact of insufficient protection against disallowed languages during content creation.
• Defenders should prioritize updating to version 2.0.3 or later of the Allowed Languages module to mitigate this vulnerability.
• Defenders need to review user access and content creation permissions in their Drupal installation to prevent potential exploitation.

Technical summary

The Allowed Languages module for Drupal does not sufficiently protect against using a disallowed language during content creation, potentially allowing unauthorized content creation. This issue is mitigated by the requirement that users must have access to create content in at least one language. The vulnerability can be addressed by updating to version 2.0.3 or later of the Allowed Languages module and reviewing user access and content creation permissions in the Drupal installation. Affected product deployments should prioritize verifying exposure and assessing the impact of this vulnerability.

Defensive priority

Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their Drupal installations, especially those using the Allowed Languages module.

Recommended defensive actions

• Verify if the Allowed Languages module is used in your Drupal installation.
• Check the version of the Allowed Languages module and update to 2.0.3 or later if necessary.
• Assess user access and content creation permissions in your Drupal installation.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and source item provide details about the vulnerability in the Allowed Languages module for Drupal. The issue arises from the module's insufficient protection against using a disallowed language during content creation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.