Project:
Project machine name:
bulk_update_user_rolesDate:
2026-October-28
Security risk:
Vulnerability:
Incorrect authorization
Affected versions:
<1.0.5
CVE IDs:
CVE-2026-118567
Description:
This module provides a bulk form for assigning or removing roles on multiple user accounts at once.
The bulk update form does not prevent access to users who do not have permission to assign roles.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer users".
Solution:
Install the latest version:
- If you use the Bulk Update User Roles module for Drupal 11, upgrade to Bulk Update User Roles 1.0.5
Reported By:
Coordinated By:
- Swan Kalata (akalata) of the Drupal Security Team
- Bram Driesen (bramdriesen) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Ivo Van Geertruyen (mr.baileys) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
