Smart Content - Moderately critical - Access bypass - SA-CONTRIB-2026-190

Project: Smart ContentProject machine name: smart_contentDate: 2026-September-23Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:AllVulnerability: Access bypassAffected versions: <3.2.1CVE IDs: CVE-2026-96386Description: This module enables you to personalize content for anonymous and authenticated users by showing different blocks to visitors based on client-side conditions.
The Smart Content Block submodule doesn't sufficiently check block access when it renders the blocks of a "Display Blocks" reaction through the module's AJAX endpoint.
This vulnerability is mitigated by the fact that a site must have placed a block whose access is restricted to certain users inside a Display Blocks reaction. Sites that only use Views blocks in reactions are not affected, because Views re-checks access when the view is executed.Solution: Install the latest version:

• Upgrade to Smart Content 3.2.1.

Reported By: 

• Tin Nguyen Huu (s4m0y3d)

Fixed By: 

• Michael Lander (michaellander)
• Tin Nguyen Huu (s4m0y3d)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team