Project:
Project machine name:
actstreamDate:
2026-October-07
Vulnerability:
Access bypass
Affected versions:
<2.0.1 || >=2.1.0 <2.1.1
CVE IDs:
CVE-2026-107257
Description:
Actstream (short for Activity Stream) aggregates a user's activity from external services (RSS feeds, etc.) into per-user activity stream entities.
The configuration route does not sufficiently check that the user editing it is the account owner (or a user administrator) leading to an access bypass vulnerability.
Solution:
Install the latest version:
- If you use Actstream 2.1.x, upgrade to Actstream 2.1.1.
- If you use Actstream 2.0.x, upgrade to Actstream 2.0.1.
Reported By:
Fixed By:
Coordinated By:
- Swan Kalata (akalata) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
