Gammu SMS Daemon for Drupal Auth Token Leakage Vulnerability Analysis (CVE-2026-76757)

Vulnerability Key Information Summary Vulnerability Overview Vulnerability Name: Gammu SMS Daemon for Drupal Authorization Token Exposure CVE ID: CVE-2026-76757 Vulnerability Type: Sensitive Information Exposure (CWE-201: Insertion of Sensitive Information into Sent Data) CVSS v4.0 Base Score: 5.3 / Medium Description: The help page of this Drupal module displays the Authorization token configured in the settings file. This token is the sole credential protecting the REST API. Any user with the permission (a privilege typically granted to all users) can view this token, thereby enabling them to invoke the REST API to send and receive SMS messages. Impact Scope Affected Versions: All released and unreleased versions (< 8.x.3) Tested Version: 8.x.1.2 Impact: Low-privilege users can obtain the production environment authorization token, allowing them to send SMS messages via the REST API, resulting in information leakage and potential abuse. Remediation During the 90-day disclosure period, the report will remain non-public if a fix is provided to users before the deadline; if no fix is provided within 90 days, the report will be made public after the 90-day period expires. The maintainer must acknowledge receipt of the report and address the issue; the current timeline indicates the maintainer initially misclassified it as a "non-issue," but the reporter subsequently clarified that the token is a production token rather than a default or demo token. POC / Exploitation Code 1. Extract the token from and render it to the template: 2. The sensitive token rendered from the Twig template: 3. Request header example displayed on the help page (including the exposed token): This token can be used to send a POST request to . 4. Reproduction steps (initial report): 1. Enable the module 2. Access as a user with the permission 3. Confirm that the token is set in "Advanced Settings" (if empty, it is auto-generated) 4. Save the page 5. Access as a user with the permission 6. Observe that the authorization token is visible

Goal Reached Thanks to every supporter — we hit 100%!

Gammu SMS Daemon for Drupal Auth Token Leakage Vulnerability Analysis (CVE-2026-76757)