CVE-2026-122058: Drupal Simple OAuth insufficient access restriction in consumer configuration

CVE-2026-122058 · Severity: info · Published 2026-11-04

Drupal's Simple OAuth module implements an OAuth 2.0 authorization server that protects Drupal instances with access tokens. Users with permissions to create or edit OAuth consumers can configure malicious consumers to obtain tokens with elevated privileges, potentially granting themselves administrative access or the ability to access the site as other users.

Technologies: Packagist:Https://Packages.Drupal.Org/8 Drupal/Simple Oauth. Vendors: Drupal, Packagist:Https://Packages.Drupal.Org/8.

Quick answers

Is CVE-2026-122058 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-122058 being exploited in the wild.
How severe is CVE-2026-122058?
Informational severity, published 4 November 2026.
Which products and versions are affected?
Drupal Simple OAuth before 5.2.6, 6.0.0 before 6.0.10, 6.1.0 before 6.1.4; Packagist:Https://Packages.Drupal.Org/8 Drupal/Simple Oauth ECOSYSTEM:introduced=0,fixed=5.2.6|ECOSYSTEM:introduced=6.0.0,fixed=6.0.10|ECOSYSTEM:introduced=6.1.0,fixed=6.1.4.
Is there a fix for CVE-2026-122058?
Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Simple Oauth: upgrade to 5.2.6 or later. Until then: Restrict the "Add consumer entities" and "Update own consumer entities" permissions to trusted roles only, and audit existing consumer configurations for unauthorized privilege escalation. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-122058 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-122058?
Check whether you run Drupal Simple OAuth or Packagist:Https://Packages.Drupal.Org/8 Drupal/Simple Oauth at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Packagist:Https://Packages.Drupal.Org/8 Drupal/Simple Oauth: upgrade to 5.2.6 or later

Restrict the "Add consumer entities" and "Update own consumer entities" permissions to trusted roles only, and audit existing consumer configurations for unauthorized privilege escalation.

Technical details

The Simple OAuth module fails to sufficiently restrict access to consumer configuration, allowing users with "Add consumer entities" or "Update own consumer entities" permissions to create or modify consumers with elevated privileges. An authenticated attacker with these permissions can configure a malicious consumer to request tokens with privileges beyond their own role, leading to privilege escalation or account takeover. Fixes are available in versions 5.2.6, 6.0.10, and 6.1.4.

Affected products

  • Drupal Simple OAuth before 5.2.6, 6.0.0 before 6.0.10, 6.1.0 before 6.1.4

Identifiers

  • CVE-2026-122058
  • DRUPAL-CONTRIB-2026-296

Timeline

  • 2026-11-04: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.