CVE-2026-16648

Name of the Vulnerable Software and Affected Versions Drupal Mailer Plus Log versions 0.0.0 through 1.2.7

Description The module fails to sufficiently redact the content of logged emails. Consequently, account-related emails are stored with their one-time login links intact. An attacker with the View Drupal Symfony Mailer log entries permission can access these links to gain unauthorized access to any account, including the administrative account (user 1). This occurs because the permission was not marked as restricted in earlier releases.

Recommendations Update Drupal Mailer Plus Log to a version later than 1.2.7. Restrict the View Drupal Symfony Mailer log entries permission to only trusted administrators.