Threats tagged 'drupal-contrib-2026-291'

The Drupal cms_content_sync module prior to version 3.2.2 insufficiently encrypted the password of the system user used for content synchronization across websites. This flaw could allow unprivileged users to view the password if they have database read access or a database dump. Exploitation requires prior access to the database, limiting the vulnerability's impact.