Threats tagged 'drupal-contrib-2026-280'

The Drupal module 'bulk_update_user_roles' has a vulnerability that allows unauthorized users to access the bulk role assignment form. This form does not restrict access properly, potentially enabling users without the correct permissions to assign or remove roles on multiple user accounts. However, exploitation requires the attacker to already have the 'administer users' permission, which limits the risk. The issue is fixed in version 1.0.5.