CVE-2012-2340: The Contact Forms module 7.x-1.x before 7.x-1.2 for Drupal does not specify sufficiently restrictive permis...

Security readout for executives and security teams

This flaw affects the Drupal Contact Forms contributed module. Users who could access the site-wide contact form could also modify module settings, even though that permission should not grant administrative control. The source bundle does not show public exploitation or a CVSS score. Exposure is likely limited to Drupal 7 sites using the Contact Forms module 7.x-1.x before 7.x-1.2, where non-administrative authenticated roles have the site-wide contact form permission. Treat this as a targeted configuration-integrity issue, not a broad unauthenticated takeover. Prioritize remediation for Drupal sites with many authenticated users or delegated low-privilege accounts. Mitigation focus: Upgrade Contact Forms to 7.x-1.2 or later where applicable.; Remove site-wide contact form access from untrusted authenticated roles.; Review module settings for unauthorized changes after remediation..

Prepared

Jun 24, 2026, 12:34 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.