Executive brief
The Advanced Content Feedback module for Drupal, which allows website visitors to provide feedback on content, contains a security flaw in how it handles user comments. An attacker with basic feedback permissions could potentially bypass authorization checks to modify or submit feedback records they do not own. This could lead to the corruption of feedback data and administrative dashboards used to improve site content.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the Drupal Advanced Content Feedback (admin_feedback) module versions 0.0.0 through 2.8.0. The module fails to sufficiently verify authorization over targeted feedback records when processing comment submissions via its AJAX endpoint. An attacker with the 'give feedback' permission (which is often granted to anonymous or authenticated users by default) can exploit this to submit comments against arbitrary feedback IDs. The fix introduced in version 2.8.0 implements HMAC-signed tokens bound to specific feedback rows and ensures comments can only be written once.
Affected products
- Drupal Advanced Content Feedback (admin_feedback) 0.0.0 to 2.8.0
Timeline
- 2026-06-24: advisory: Drupal security advisory SA-CONTRIB-2026-052 published
- 2026-06-24: patched: Version 2.8.0 released to address the vulnerability
- 2026-07-10: disclosed: CVE-2026-13232 published to NVD