Project: 
SAML SSO - Service Provider
Project machine name: 
miniorange_saml
Date: 
2026-September-09
Security risk: 
Critical 18 ∕ 25 AC:None/A:None/CI:Some/II:Some/E:Theoretical/TD:All
Vulnerability: 
Improper access control
Affected versions: 
<3.2.0
CVE IDs: 
CVE-2026-87943
Description: 

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider.

The miniorange_saml module does not correctly restrict access to certain functionality intended for administrative use. This could allow unauthorized users to access functionality or modify configuration values that should only be available to privileged users.

Solution: 

Install the latest version:

Reported By: 
Fixed By: 
Coordinated By: