CVE-2026-0944
📋 TL;DR
This vulnerability in Drupal Group invite allows attackers to bypass access controls through forceful browsing, potentially accessing restricted content or functionality. It affects Drupal sites using the Group invite module in specific vulnerable versions.
💻 Affected Systems
- Drupal Group invite module
📦 What is this software?
Group Invite by Metadrop
Group Invite by Metadrop
Group Invite by Metadrop
⚠️ Risk & Real-World Impact
Worst Case
Unauthorized users gain access to sensitive group content, member data, or administrative functions they shouldn't have permission to view or modify.
Likely Case
Attackers access restricted group content or functionality they shouldn't be able to see, potentially exposing private information.
If Mitigated
Limited impact with proper access controls and monitoring, though some information disclosure may still occur.
🎯 Exploit Status
Exploitation requires some knowledge of Drupal's URL structure but is relatively straightforward once understood.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.3.9, 3.0.4, or 4.0.4
Vendor Advisory: https://www.drupal.org/sa-contrib-2026-001
Restart Required: No
Instructions:
1. Update Group invite module to version 2.3.9, 3.0.4, or 4.0.4 depending on your major version. 2. Clear Drupal caches. 3. Verify the update was successful.
🔧 Temporary Workarounds
Temporary access restriction
allTemporarily disable or restrict access to group invite functionality
🧯 If You Can't Patch
- Implement additional access control checks at the application level
- Monitor logs for unusual access patterns to group-related URLs
🔍 How to Verify
Check if Vulnerable:
Check Group invite module version in Drupal admin interface at /admin/modules or via drush: drush pm-list | grep group_inviteCheck Version:
drush pm-list | grep group_inviteVerify Fix Applied:
Confirm module version is 2.3.9, 3.0.4, or 4.0.4 and test access controls work properly📡 Detection & Monitoring
Log Indicators:
- Multiple failed access attempts to group invite URLs
- Unauthorized users accessing group invite endpoints
Network Indicators:
- Unusual patterns of requests to /group/* or /invite/* endpoints
SIEM Query:
source="drupal_access_log" AND (uri="/group/*" OR uri="/invite/*") AND status=403