CVE-2015-5515: The Views Bulk Operations (VBO) module 6.x-1.x and 7.x-3.x before 7.x-3.3 for Drupal, when the bulk operati...

Security readout for executives and security teams

This Drupal contributed module flaw can let a logged-in user grant roles to user accounts when a VBO-enabled user listing exposes the role-changing bulk operation. Business impact depends on whether those roles include administrative or privileged access. The source bundle does not show active exploitation. Exposure is likely limited to Drupal sites using the Views Bulk Operations module with a user account listing view and the role-changing bulk operation enabled. Anonymous users are not described as affected; the attacker must be authenticated and able to access that VBO-enabled view. Prioritize remediation on Drupal sites where VBO can modify user roles, especially public-facing portals with many authenticated users. Treat as high priority because successful abuse can create administrative access without needing unauthenticated compromise. Mitigation focus: Upgrade VBO 7.x-3.x to 7.x-3.3 or later where applicable.; Check Drupal advisory guidance for affected 6.x-1.x deployments.; Disable the VBO role-changing bulk operation unless strictly required..

Prepared

Jun 13, 2026, 22:03 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.