CVE-2026-16648: Drupal Symfony Mailer Log Module Email Content Exposure Vulnerability
Summary
CVE-2026-16648: This module enables you to log the emails sent by Mailer Plus as content entities, so they can be reviewed at Reports > Mail log. Affects drupal/symfony_mailer_log versions < 1.2.7. Fixed in 1.2.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Drupal Symfony Mailer Log module is designed to log emails sent by the Mailer Plus as content entities, allowing users to review email logs at Reports > Mail log. This module is essential for tracking email communications within a Drupal application, providing insights into email activities. However, it has a critical vulnerability that exposes sensitive information.
Vulnerability Detail
The vulnerability arises from the module's failure to adequately redact the content of the emails it logs. Specifically, account-related emails are stored with their one-time login links intact. This means that any user with the permission to view the log can access these links, potentially allowing them to log in as any account, including the administrator account (user 1). The risk is heightened as the permission to view these logs was not previously marked as restricted in earlier releases, making it easier for unauthorized users to exploit this vulnerability.
How To Fix
Minimum fixed version
1.2.7
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the 'View Drupal Symfony Mailer log entries' permission to trusted roles only. This will help mitigate the risk until the module is updated.
Conclusion
The Drupal Symfony Mailer Log module has a significant vulnerability that can expose sensitive email content, including one-time login links. It is crucial to update the module to version 1.2.7 or later to mitigate this risk. Additionally, using tools like Vulert can help monitor for such vulnerabilities in your applications.
See every vulnerability recorded for drupal/symfony_mailer_log →
FAQ
CVE-2026-16648 is a vulnerability in the Drupal Symfony Mailer Log module that allows unauthorized users to access sensitive email content, including one-time login links.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities without requiring any installation.
If you cannot update the module right away, ensure that only trusted users have access to the permission that allows viewing the mail log entries to minimize risk.
Yes, Vulert can monitor your project for vulnerabilities using just a manifest file like package-lock.json, providing real-time alerts.
Failing to address this vulnerability could lead to unauthorized access to user accounts, compromising sensitive information and potentially allowing attackers to take control of accounts.
