Executive brief
The ECA (Event - Condition - Action) module for Drupal, which allows site administrators to create automated workflows without writing code, contains a security flaw in its Twig rendering component. If a site uses specific automated actions to process data, an attacker could potentially view sensitive information that should otherwise be restricted. This risk is limited to sites using the 'Render: Twig' action within their custom workflows.
Technical details
A vulnerability exists in the ECA Render submodule where Twig templates are not sufficiently sanitized during the rendering process within ECA models. Specifically, when the 'Render: Twig' action is utilized in a data flow, it may allow for the disclosure of sensitive information. The attack requires the site to have a specific configuration (an active ECA model using the affected action) and likely requires some level of authenticated access to influence the data being rendered. The issue is addressed in versions 2.1.20, 3.0.12, and 3.1.4. Note: While the NVD description mentions Object Injection (CWE-915), the primary Drupal advisory classifies this as Information Disclosure.
Affected products
- Drupal ECA: Event - Condition - Action 0.0.0 to 2.1.19, 3.0.0 to 3.0.11, 3.1.0 to 3.1.3
Timeline
- 2026-07-08: advisory: Drupal security advisory SA-CONTRIB-2026-074 published
- 2026-07-10: disclosed: CVE-2026-15083 published to NVD