Skip to content

Authorization Token Disclosure in Gammu SMS Daemon for Drupal

About the product:

Homepage: https://www.drupal.org/project/gammu_smsd
Source repository: https://git.drupalcode.org/project/gammu_smsd
Package: composer:drupal/gammu_smsd

Drupal Gammu SMS Daemon is intended to allow a Drupal site to integrate with the Gammu SMS Daemon (smsd) for the sending and receiving of SMS messages.

The program provides: * A web UI for administrates to view/send messages. * A REST API endpoint protected by an administrator chosen token. * A help page for documenting use of the REST API * A PHP API for use be other applications.

Vulnerability info

The program provides a help page that located at admin/help/gammu_smsd that displays the configured token to any use with the Drupal Core access help pages permissions.

This flaw can be tracked to \gammu_smsd_help() retrieving te token from current configuration and providing the variable to a twig template for rendering 

$token = $config->get('gammu_token');
$twig_service = \Drupal::service('twig');
$template_file = $path . '/templates/gammu-smsd-help-body.html.twig';
$variables = [
  'token' => $token,
  'theme_hook_original' => 'not-applicable',
];
return $twig_service->load($template_file)->render($variables);
Source: \gammu_smsd_help()

<code>
  Content-Type: application/json<br/>
  Authorization: {{ token }}
</code>
Source gammu-smsd-help-body.html.twig L20-L23

The access help pages permission is commonly given to any user with any access to the admin portion of the site. This may range from content editors to full system administrators. There is no documentation that the access code is provided to all users. In discussions the project maintainer confirmed that the

The REST API only requires the authorization token to generate SMS messages.

A POC formated as a Drupal PHPUnit test is available on Github.

Attack requirements

  • An account with the Drupal Core access help pages permission.

Impacted versions

All current published and unpublished releases are believed to be vulnerable (<= 8.x-1.3)

CVE score

CVSS v4.0 Base Score: 5.3 / Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

Additional information

Tested against 8.x-1.2.

The maintainer of the product was contacted through their published vulnerability reporting service. At time of issue opening they were provided the following coordinated disclosure timeline notice

This report is subject to a 90 day disclosure policy. If a fix for this report is made available to users before the end of the 90-day timeline, this report report will become public 30 days after the fix was made available. If no fix is made available this report will become public at the 90 day mark. The timeline may be shortened in response to an increase in public risk.

Initial report

The replication steps provided in the initial report were as follows:

  1. Enabling the module
  2. As a user with administer site configuration permission visit admin/config/services/gammu-smsd
  3. Ensure a token is set under "Advanced settings > Authorization" (one will be auto generated on form load if field is empty).
  4. Save the page
  5. As a user with access help pages permission visit admin/help/gammu_smsd
  6. Observe the authorization token is visible.

Timeline

17/05/2026

Report submitted to project through their registered vulnerability reporting service. Report automatically acknowledged by reporting service.

04/06/2026-1

Inquiry to product maintainer to confirm they have received the report and are working on the issue.

04/06/2026-2

Reporting service confirmed that maintainer had been active in the previous month.

19/06/2026-1

Notice provided to maintainer and reporting service that 30 days elapsed without confirmation from maintainer. Maintainer advised that failure to acknowledge within 2 weeks would result in issue being classfied as maintainer failed to respond to contact requests which is considered an increase risk to the public that may result in early disclosure.

19/06/2026-2

Reporting service advised they were reaching out to the project maintainers through alternative channels.

20/06/2026-1

Maintainer advised they do not understand the concern being raised in the vulnerabilit report.

20/06/2026-2

Repeated to maintainer that the page was available to low privilege users and that the token remaining secret was the only protection for the REST API.

02/07/2026-1

Maintainer reported they were unable to duplicate the reported concern.

02/07/2026-2

Advised maintainer that they tested wrong URL and repeated the step from the initial report for clarity.

20/07/2026-1

Maintainer advised they felt that since site owners could change the token that a default code being displayed was a non-issue.

20/07/2026-2

Advised maintainer that this is the production token, not a default or demo token. Note that the issue is within 30 days of disclosure.

27/07/2026

Reporting service requested an update from maintainer.

16/08/2026

Report disclosed by reporter.