Simple user management: This module lets non-administrators approve, deactivate and delete users, limited by the roles they can delegate through Role Delegation. (CVE-2026-114543)

The vulnerability in the Drupal Simple User Management module (CVE-2026-114543) arises from inadequate checks on role delegation during user approval processes. This flaw allows non-administrators with delegated permissions to approve users without sufficient validation, potentially activating blocked administrators. Furthermore, the module lacks safeguards to prevent deactivation or deletion of the primary user account (user 1). The risk is mitigated by the prerequisite that an attacker must already possess a role with the module's additional action permissions.

An attacker with a role that includes the module's additional action permissions could approve users improperly, activate blocked administrators, or deactivate/delete critical user accounts including user 1. This could lead to unauthorized account management actions within the Drupal environment, potentially compromising administrative control.

A patch is available for this vulnerability. Users of the Simple User Management module should upgrade to version 1.11.0 or later to address these issues. Since the vulnerability requires specific permissions, reviewing and restricting role delegation and action permissions can reduce risk until the patch is applied.