CVE-2007-5597: The hook_comments API in Drupal 4.7.x before 4.7.8 and 5.x before 5.3 does not pass publication status, whi...

Security readout for executives and security teams

A flaw in older Drupal versions could let comment-related modules send email notifications containing unpublished comments to users who should not see them. This is a confidentiality and access-control issue. The bundle names Drupal 4.7.x before 4.7.8 and 5.x before 5.3. Exposure is likely limited to legacy Drupal 4.7.x or 5.x sites using modules that send or process comment notifications, specifically examples such as Organic groups or Subscriptions. Modern Drupal versions are not identified as affected in the bundle. Treat this as a cleanup priority for legacy Drupal estates, especially where unpublished comments may contain sensitive customer, staff, or moderation content. It is not supported as actively exploited by the provided sources, but affected systems are very old and should be retired or upgraded. Mitigation focus: Upgrade Drupal 4.7.x to 4.7.8 or later.; Upgrade Drupal 5.x to 5.3 or later.; Review vendor and distribution advisories for package-specific guidance..

Prepared

Jun 29, 2026, 02:08 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.