This module provides a new UI experience for node editing using the Gutenberg Editor library. (CVE-2026-107263)

The drupal/gutenberg module, which provides a new UI experience for node editing using the Gutenberg Editor library, contains a vulnerability where entity access is not sufficiently checked in multiple editor endpoints. This flaw could potentially allow unauthorized actions within the editor interface. However, exploitation is limited to users who already possess the “use gutenberg” permission role. Versions prior to 2.15.0 and versions from 3.0.0 up to but not including 3.0.7 are affected. A patch is available to remediate this vulnerability.

An attacker with a role that includes the “use gutenberg” permission could exploit the insufficient entity access checks to perform unauthorized actions within the editor endpoints. This limits the impact to users with elevated permissions rather than unauthenticated or low-privilege users.

Apply the available patch to update the drupal/gutenberg module to version 2.15.0 or later, or 3.0.7 or later. Since a patch is available, remediation should be performed promptly to prevent potential exploitation. No additional mitigation is indicated by the vendor advisory.