Agora theme: This theme provides a front-end design for transparency and open-government sites, including a table preview of CSV files attached to content. (CVE-2026-114533)
Description
The Agora theme for Drupal provides a front-end design for transparency and open-government sites, including a feature to preview CSV files attached to content. However, it insufficiently checks file access when rendering these previews, allowing visitors who cannot download the file to still read its contents on the page. Additionally, previews rendered for one visitor can be cached and shown to others. This vulnerability only affects CSV files stored outside the public file system and requires additional access restrictions beyond content access. Files stored in the public file system are not impacted. A patch is available for versions prior to 1.2.3.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Agora theme for Drupal (versions before 1.2.3) has a vulnerability where it does not properly verify file access permissions when rendering CSV file previews. This allows users who are denied file downloads to still view the contents of those CSV files via the preview feature. Furthermore, the preview content can be cached and served to other users, potentially exposing sensitive data. The vulnerability is mitigated if CSV files are stored in the public file system or if additional access restrictions are implemented. A patch addressing this issue is available.
Potential Impact
Unauthorized users may view the contents of CSV files attached to content even if they are denied direct download access. This could lead to unintended disclosure of sensitive or restricted data through the preview feature. Cached previews may also expose data to other users. The impact is limited to files stored outside the public file system and where additional access controls are not in place.
Mitigation Recommendations
A patch is available for this vulnerability; upgrading to version 1.2.3 or later of the Agora theme is recommended. Additionally, ensure CSV files are stored in the public file system or that proper access restrictions are enforced via modules or custom code to prevent unauthorized file access. No further action is required if these mitigations are already in place.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- DRUPAL-CONTRIB-2026-231
- Osv Schema Version
- 1.7.0
- Aliases
- ["CVE-2026-114533"]
- Ecosystems
- ["Packagist:https://packages.drupal.org/8"]
Threat ID: 6ad91ca94d27ba8daafa91bd
Added to database: 10/21/2026, 20:12:25 UTC
Last enriched: 10/21/2026, 20:14:23 UTC
Last updated: 10/21/2026, 20:14:23 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.