Quick answers
- Is CVE-2026-76757 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-76757 being exploited in the wild.
- How severe is CVE-2026-76757?
- Medium severity, with a CVSS score of 5.9, published 2 September 2026.
- Which products and versions are affected?
- Drupal Gammu SMS Daemon 8.x-1.3 and earlier.
- Is there a fix for CVE-2026-76757?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-76757 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-76757?
- Check whether you run Drupal Gammu SMS Daemon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an information disclosure (CWE-201) in the \gammu_smsd_help() function, which retrieves the configured REST API authorization token from site configuration and passes it unsanitized to a Twig template that displays it as plain text in the admin help page. The vulnerable page is accessible to any user with the "access help pages" permission, which is typically granted to content editors and other low-privilege admin users, not just system administrators. No user interaction is required; viewing admin/help/gammu_smsd directly reveals the token. An attacker can then use the disclosed token to authenticate requests to the REST API endpoint and send SMS messages. The module maintainer did not address the issue during the 90-day disclosure window, and all published versions (≤8.x-1.3) remain vulnerable.
Affected products
- Drupal Gammu SMS Daemon 8.x-1.3 and earlier
Timeline
- 2026-05-17: disclosed: Report submitted to project through vulnerability reporting service
- 2026-06-04: other: Inquiry to maintainer; no acknowledgment of issue
- 2026-06-19: other: Notice to maintainer of lack of response; threat of early disclosure
- 2026-06-20: other: Maintainer claimed to not understand the concern
- 2026-07-02: other: Maintainer claimed unable to duplicate; provided corrected steps
- 2026-07-20: other: Maintainer disputed severity (30 days before disclosure)
- 2026-08-16: disclosed: Report disclosed by reporter; CVE ID requested
- 2026-08-19: other: CVE-2026-76757 assigned