# CVE-2026-126740: Drupal Download Count access bypass in permission checks

Source: https://junglewise.ai/threats/cve-2026-126740-drupal-contrib-2026-331-this-module-tracks-file-downloads-for  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-13  
License: CC BY 4.0 with a link back

CVE-2026-126740 · Severity: info · Published 2026-11-11

The Download Count Drupal module tracks file downloads for private files and generates reports, but fails to properly verify permissions for sensitive operations. An attacker with only the basic "View download counts" permission can export the download log and delete all records, potentially destroying audit trails and exposing download history. The attack requires the attacker to already have a user account with this permission granted.

Vendors: [Drupal](https://junglewise.ai/threats/vendors/drupal), [Packagist:Https://Packages.Drupal.Org/8](https://junglewise.ai/threats/vendors/packagist-https-packages-drupal-org-8).

## Quick answers

**Is CVE-2026-126740 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126740 being exploited in the wild.

**How severe is CVE-2026-126740?** Informational severity, published 11 November 2026.

**Which products and versions are affected?** Drupal Download Count <2.2.5, >=3.0.0 <3.0.2; Packagist:Https://Packages.Drupal.Org/8 Drupal/Download Count ECOSYSTEM:introduced=0,fixed=2.2.5|ECOSYSTEM:introduced=3.0.0,fixed=3.0.2.

**Is there a fix for CVE-2026-126740?** Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Download Count: upgrade to 2.2.5 or later. Until then: After upgrading to the patched versions, restrict the "reset download counts" and "export download counts" permissions only to roles that genuinely require them, rather than granting them broadly. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-126740 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-126740?** Check whether you run Drupal Download Count or Packagist:Https://Packages.Drupal.Org/8 Drupal/Download Count at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Packagist:Https://Packages.Drupal.Org/8 Drupal/Download Count: upgrade to 2.2.5 or later

After upgrading to the patched versions, restrict the "reset download counts" and "export download counts" permissions only to roles that genuinely require them, rather than granting them broadly.

## Technical details

The module provides permission checks that are never actually enforced on sensitive operations like exporting logs and resetting download counts. An authenticated user with the "View download counts" permission can bypass access controls to perform privileged actions (export and delete records) that should be restricted to higher-privilege roles. A fix is available in versions 2.2.5 and 3.0.2.

## Affected products

- Drupal Download Count <2.2.5, >=3.0.0 <3.0.2

## Identifiers

- CVE-2026-126740
- DRUPAL-CONTRIB-2026-331

## Timeline

- 2026-11-11: disclosed

## References

- [https://www.drupal.org/u/rduterte](https://www.drupal.org/u/rduterte)
- [https://www.drupal.org/sa-contrib-2026-331](https://www.drupal.org/sa-contrib-2026-331)