CVE-2026-114542: Drupal Simple OAuth permission cache reuse privilege escalation

CVE-2026-114542 · Severity: info · Published 2026-10-30

The Simple OAuth module for Drupal is an authentication add-on that manages access tokens for API requests. Versions 6.1.0 through 6.1.2 incorrectly cache user permissions in a way that allows one user's access token to be reused to gain the permissions of another user's token with the same scopes, potentially including administrator access. An attacker must obtain a valid OAuth token from someone with higher privileges to exploit this vulnerability; they cannot create the conditions themselves.

Technologies: Packagist:Https://Packages.Drupal.Org/8 Drupal/Simple Oauth. Vendors: Drupal, Packagist:Https://Packages.Drupal.Org/8.

Quick answers

Is CVE-2026-114542 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-114542 being exploited in the wild.
How severe is CVE-2026-114542?
Informational severity, published 30 October 2026.
Which products and versions are affected?
Drupal Simple OAuth 6.1.0 to 6.1.2; Packagist:Https://Packages.Drupal.Org/8 Drupal/Simple Oauth ECOSYSTEM:introduced=6.1.0,fixed=6.1.3.
Is there a fix for CVE-2026-114542?
Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Simple Oauth: upgrade to 6.1.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114542 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-114542?
Check whether you run Drupal Simple OAuth or Packagist:Https://Packages.Drupal.Org/8 Drupal/Simple Oauth at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Packagist:Https://Packages.Drupal.Org/8 Drupal/Simple Oauth: upgrade to 6.1.3 or later

Technical details

The vulnerability stems from improper caching of token permissions in the Simple OAuth module. When a token with certain scopes is used, its associated permissions are cached in a way that can be reused by a different user's token with identical scopes, allowing privilege escalation. This requires an attacker to already possess a valid OAuth2 token and for a more privileged user's token with the same scopes to have been used first; the issue does not affect Drupal's User 1 account unless security.enable_super_user is explicitly disabled.

Affected products

  • Drupal Simple OAuth 6.1.0 to 6.1.2

Identifiers

  • CVE-2026-114542
  • DRUPAL-CONTRIB-2026-242

Timeline

  • 2026-10-21: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.