Is CVE-2026-76756 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-76756 being exploited in the wild.

How severe is CVE-2026-76756?

Medium severity, with a CVSS score of 5.9, published 2 September 2026.

Which products and versions are affected?

Drupal Gammu SMS Daemon 8.x-1.2 and earlier.

Is there a fix for CVE-2026-76756?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-76756 attacked?

It is attacked over the network or from the adjacent network, in a web application.

Am I affected by CVE-2026-76756?

Check whether you run Drupal Gammu SMS Daemon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-76756: Drupal Gammu SMS Daemon timing attack in REST API authentication

CVE-2026-76756 · Severity: medium · CVSS 5.9 · Published 2026-09-02

The Drupal Gammu SMS Daemon module provides an interface for sending SMS messages through the Gammu SMS system. A timing vulnerability in the REST API token validation logic could allow an attacker with network proximity to infer the correct authentication token through statistical analysis of response times, potentially gaining unauthorized access to send or view SMS messages.

Technologies: Drupal Gammu SMS Daemon. Vendors: Drupal.

Quick answers

Is CVE-2026-76756 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-76756 being exploited in the wild.
How severe is CVE-2026-76756?: Medium severity, with a CVSS score of 5.9, published 2 September 2026.
Which products and versions are affected?: Drupal Gammu SMS Daemon 8.x-1.2 and earlier.
Is there a fix for CVE-2026-76756?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-76756 attacked?: It is attacked over the network or from the adjacent network, in a web application.
Am I affected by CVE-2026-76756?: Check whether you run Drupal Gammu SMS Daemon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a timing-based side-channel attack (CWE-208) in the GammuApiController::send() method, where the API token is compared using a non-timing-safe equality operator (==) rather than a constant-time comparison function. An attacker with adjacency or low-latency network access could perform repeated API calls with guessed tokens and measure response time variations to deduce the correct authentication key byte-by-byte. The attack requires adjacency or other low-latency network positioning and does not require authentication, but successful exploitation requires sufficient time and resources for statistical analysis. A fix using a timing-safe comparison method was committed to the repository on 20 June 2026, and the vulnerability affects all published releases up to 8.x-1.2.

Affected products

Drupal Gammu SMS Daemon 8.x-1.2 and earlier

Timeline

2026-05-17: disclosed: Vulnerability reported to maintainer through Drupal's vulnerability reporting service
2026-06-20: other: Maintainer committed fix using timing-safe comparison method
2026-08-16: advisory: Vulnerability publicly disclosed by researcher
2026-08-19: other: CVE-2026-76756 assigned

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.