The module provides a permission that allows users to configure email templates containing Twig code.
Impact
The module provides a permission that allows users to configure email templates containing Twig code. This permission was not marked as restricted.
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
| Affected range | Recorded fix |
|---|---|
| Earlier releases before 3.9.0Ecosystem versions | 3.9.0 |
Version evidence: OSV · DRUPAL-CONTRIB-2026-107
View original version evidence (0 explicit versions)
Original source description
The module provides a permission that allows users to configure email templates containing Twig code. This permission was not marked as restricted.
A site administrator might inadvertently grant this permission to less-trusted users. This would allow those users to execute Twig within email templates, and to gain access to functionality and information intended only for highly trusted administrators.