Swiper formatter: Swiper is mobile first, layout and gestures wise, it provides great amount of options for designing your own widget and related events. (CVE-2026-114535)

The Swiper formatter module in Drupal allows displaying published content entities via a dialog route. This route lacks adequate verification of the current user's access permissions to the specific entity, potentially exposing content. Despite this, the vulnerability's impact is limited since only rendered output is returned and field-level access controls continue to apply. The affected versions are those before 2.1.2 and versions from 3.0.1 up to but not including 3.1.0. A patch is available to address this issue.

Insufficient access verification could allow users to access rendered content entities they might not be authorized to view through the dialog route. However, because only rendered output is returned and field-level access controls are still enforced, the risk of unauthorized data exposure is reduced.

A patch is available for this vulnerability. Users should upgrade to versions 2.1.2 or later and 3.1.0 or later to remediate the issue. No additional mitigation steps are indicated as field-level access controls remain in place.