CVE-2026-122082 Drupal CVE debrief

Who should care

Drupal site administrators and security teams should assess exposure, especially those using the Mime Mail module and handling sensitive data uploads. They should verify and restrict user permissions for sending HTML emails, review and update Mime Mail module versions, and monitor for unusual email sending activities.

Why it matters

Defenders should care about CVE-2026-122082 as it involves a potential data exposure vulnerability in the Mime Mail module for Drupal. Site administrators and security teams should assess their exposure, especially if they handle sensitive data uploads or have users with permission to send HTML emails. The vulnerability requires advance knowledge of uploaded files and the ability to send HTML emails, but could lead to unintended data disclosure.

• Potential data exposure through HTML email sending
• Need to verify and restrict user permissions for sending HTML emails
• Possible impact on sites handling sensitive data uploads
• Requires review and update of Mime Mail module versions

Technical summary

The Mime Mail module for Drupal allows sites to send HTML email messages. Under rare site configuration conditions, a user with permission to send HTML emails could send non-public data uploaded to the files directory. This requires advance knowledge of uploaded files and the ability to send HTML emails and set recipient lists. The vulnerability is mitigated by the need for advance knowledge of uploaded files and the ability to send HTML emails. Official sources confirm the issue but provide limited details on exploitation or impact.

Defensive priority

Defenders should prioritize verifying and restricting user permissions for sending HTML emails, especially in configurations where sensitive data is handled.

Recommended defensive actions

• Verify and restrict user permissions for sending HTML emails
• Review and update Mime Mail module versions to 2.0.4 or later
• Monitor for unusual email sending activities
• Implement additional access controls for sensitive data uploads
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is mitigated by the need for advance knowledge of uploaded files and the ability to send HTML emails. Official sources confirm the issue but provide limited details on exploitation or impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.