CVE-2026-118568

Name of the Vulnerable Software and Affected Versions Drupal Content Sync (content-sync.io) versions 0.0.0 through 3.2.2

Description Insecure storage of sensitive information allows for the retrieval of embedded sensitive data. The module fails to sufficiently encrypt the password of the system user utilized during content synchronization, which may allow unprivileged users to view the password. Exploitation requires the attacker to have prior database read access or a database dump of the user data table.

Recommendations Update Drupal Content Sync (content-sync.io) to a version later than 3.2.2.