CVE-2026-13232: Drupal Admin Feedback Module Insufficient Authorization Vulnerability
Summary
CVE-2026-13232: This module enables you to collect feedback from your site visitors on content pages, allowing them to optionally attach a free-text comment to their Yes/No vote. Affects drupal/admin_feedback versions < 2.8.0. Fixed in 2.8.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Drupal Admin Feedback module allows site visitors to provide feedback on content pages, including the option to attach comments to their Yes/No votes. This module is widely used in Drupal applications to enhance user engagement and gather insights. However, it has a critical vulnerability that arises from inadequate authorization checks when processing comment submissions, potentially allowing unauthorized users to manipulate feedback records.
Vulnerability Detail
The vulnerability stems from the module's failure to properly verify user authorization over the feedback records during comment submissions. This oversight means that an attacker with the 'give feedback' permission can exploit this flaw to submit comments on behalf of other users or manipulate existing feedback records. The risk is heightened as this permission is granted by default to both anonymous and authenticated users upon installation, making it accessible to a broad range of potential attackers.
How To Fix
Minimum fixed version
2.8.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict the 'give feedback' permission to trusted user roles only, thereby limiting the exposure of this vulnerability until an update can be applied. This can be done by navigating to the permissions settings in your Drupal admin panel and adjusting the permissions accordingly.
Conclusion
The CVE-2026-13232 vulnerability in the Drupal Admin Feedback module highlights the importance of proper authorization checks in web applications. By updating to the latest version and implementing recommended workarounds, site administrators can protect their applications from potential exploitation.
See every vulnerability recorded for drupal/admin_feedback →
FAQ
CVE-2026-13232 is a vulnerability in the Drupal Admin Feedback module that allows unauthorized users to submit comments on feedback records due to insufficient authorization checks.
Any Drupal site using the Admin Feedback module version prior to 2.8.0 is potentially affected, especially if the 'give feedback' permission is granted to anonymous users.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider restricting the 'give feedback' permission to trusted roles only as a temporary measure.
While the primary risk is unauthorized comment submissions, it could lead to misinformation or manipulation of feedback data, impacting the integrity of user feedback.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/admin_feedback.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
