Project: 
Gutenberg
Project machine name: 
gutenberg
Date: 
2026-October-07
Security risk: 
Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default
Vulnerability: 
Access bypass
Affected versions: 
<2.15.0 || >=3.0.0 <3.0.7
CVE IDs: 
CVE-2026-107263
Description: 

This module provides a new UI experience for node editing using the Gutenberg Editor library.

The module does not sufficiently check entity access in several editor endpoints.

This vulnerability is mitigated by the fact that an attacker must have a role with the “use gutenberg” permission.

Solution: 

Install the latest version:

  • If you use the Gutenberg module versions 3.0.x, upgrade to Gutenberg 3.0.7
  • If you use the Gutenberg module versions 8.x-2.x, upgrade to Gutenberg 8.x-2.15
Reported By: 
Fixed By: 
Coordinated By: