Executive brief
The Gammu SMS Daemon module for Drupal is used to send and receive SMS messages through a REST API protected by an authentication token. A vulnerability in the module's help page allows any user with basic help-page access to view the configured API token in plain text, effectively bypassing API authentication. An attacker with low-privilege Drupal account access could steal this token and send unauthorized SMS messages or access the module's API functions.
Technical details
The vulnerability is an information disclosure (CWE-201) in the \gammu_smsd_help() function, which retrieves the configured REST API authorization token from site configuration and passes it unsanitized to a Twig template that displays it as plain text in the admin help page. The vulnerable page is accessible to any user with the "access help pages" permission, which is typically granted to content editors and other low-privilege admin users, not just system administrators. No user interaction is required; viewing admin/help/gammu_smsd directly reveals the token. An attacker can then use the disclosed token to authenticate requests to the REST API endpoint and send SMS messages. The module maintainer did not address the issue during the 90-day disclosure window, and all published versions (≤8.x-1.3) remain vulnerable.
Affected products
- Drupal Gammu SMS Daemon 8.x-1.3 and earlier
Timeline
- 2026-05-17: disclosed: Report submitted to project through vulnerability reporting service
- 2026-06-04: other: Inquiry to maintainer; no acknowledgment of issue
- 2026-06-19: other: Notice to maintainer of lack of response; threat of early disclosure
- 2026-06-20: other: Maintainer claimed to not understand the concern
- 2026-07-02: other: Maintainer claimed unable to duplicate; provided corrected steps
- 2026-07-20: other: Maintainer disputed severity (30 days before disclosure)
- 2026-08-16: disclosed: Report disclosed by reporter; CVE ID requested
- 2026-08-19: other: CVE-2026-76757 assigned