CVE-2026-1553: DRUPAL-CONTRIB-2026-006 - This Drupal Canvas module is a new visual page builder for Drupal. You can create reusable…

CVE-2026-1553 · Severity: info · Published 2026-01-28

This Drupal Canvas module is a new visual page builder for Drupal. You can create reusable components that match your design system, drag them onto a page, edit content in place, preview changes across multiple pages, and undo mistakes with ease.

The module doesn't sufficiently validate access to Canvas Pages when they are unpublished.

This vulnerability is mitigated by the fact that Canvas Pages don't have content moderation enabled by default, and they must be unpublished after being released, and archiving is not a feature provided by the module yet.

Technologies: Packagist:Https://Packages.Drupal.Org/8 Drupal/Canvas. Vendors: Packagist:Https://Packages.Drupal.Org/8.

Quick answers

Is CVE-2026-1553 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-1553 being exploited in the wild.
How severe is CVE-2026-1553?
Informational severity, published 28 January 2026.
Which products and versions are affected?
Packagist:Https://Packages.Drupal.Org/8 Drupal/Canvas ECOSYSTEM:introduced=0,fixed=1.0.4.
Is there a fix for CVE-2026-1553?
Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Canvas: upgrade to 1.0.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected by CVE-2026-1553?
Check whether you run Packagist:Https://Packages.Drupal.Org/8 Drupal/Canvas at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Packagist:Https://Packages.Drupal.Org/8 Drupal/Canvas: upgrade to 1.0.4 or later

Affected products

  • Packagist:Https://Packages.Drupal.Org/8 Drupal/Canvas ECOSYSTEM:introduced=0,fixed=1.0.4

Identifiers

  • CVE-2026-1553
  • DRUPAL-CONTRIB-2026-006

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.