911 matches found
CVE-2026-107251
The Entity Reference Manager (Merge entities) module for Drupal is affected by an Incorrect Authorization vulnerability (CWE-863). This flaw occurs because the module fails to sufficiently restrict access to all entity management operations. Consequently, users with content viewing permissions ca...
EUVD-2026-113581
Incorrect Authorization vulnerability in Drupal Entity Reference Manager Merge entities allows Forceful Browsing. This issue affects Entity Reference Manager Merge entities versions: from 0.0.0 to 1.0.3...
CVE-2026-107257
A critical Incorrect Authorization vulnerability exists in the Drupal Actstream module, specifically affecting versions 0.0.0 to 2.0.1 and 2.1.0 to 2.1.1 . The root cause is a failure in the configuration route , which does not sufficiently verify that the user editing the configuration is the ac...
EUVD-2026-113577
Incorrect Authorization vulnerability in Drupal Actstream allows Forceful Browsing. This issue affects Actstream versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1...
CVE-2026-107258
The Inline Entity Form Dialog module for Drupal (versions 0.0.0 to 1.0.6 ) is vulnerable to an Incorrect Authorization issue (CWE-863) allowing Forceful Browsing . The root cause is that the module verifies only the "access administration pages" permission without checking if the current user has...
EUVD-2026-113576
Incorrect Authorization vulnerability in Drupal Inline Entity Form Dialog allows Forceful Browsing. This issue affects Inline Entity Form Dialog versions: from 0.0.0 to 1.0.6...
CVE-2026-107263
The Gutenberg module for Drupal (versions 0.0.0 to 2.15.0 and 3.0.0 to 3.0.7 ) is vulnerable to an Incorrect Authorization issue (CWE-863). The root cause is that the module fails to sufficiently check entity access across several editor endpoints, which can lead to Forceful Browsing . While the ...
EUVD-2026-113573
Incorrect Authorization vulnerability in Drupal Gutenberg allows Forceful Browsing. This issue affects Gutenberg versions: from 0.0.0 to 2.15.0, from 3.0.0 to 3.0.7...
CVE-2026-107266
The Drupal Views Share module (versions 0.0.0 to 2.0.1 ) is vulnerable to a missing authorization issue that allows forceful browsing . Because the module fails to sufficiently block access to view displays, an attacker who knows the specific view and display IDs can execute resource-intensive vi...
EUVD-2026-113570
Missing Authorization vulnerability in Drupal Views Share allows Forceful Browsing. This issue affects Views Share versions: from 0.0.0 to 2.0.1...
CVE-2026-96389
The Drupal Xray Audit module is vulnerable to an access bypass issue due to missing authorization checks. Specifically, the module fails to sufficiently verify entity access when rendering an entity via the display-mode example route . This flaw allows an attacker to perform Forceful Browsing to ...
EUVD-2026-113569
Missing Authorization vulnerability in Drupal Xray Audit allows Forceful Browsing. This issue affects Xray Audit versions: from 0.0.0 to 1.6.3, from 2.0.0 to 2.0.4, from 3.0.0 to 3.1.1...
CVE-2026-107268
The Two Factor Authentication - TFA / Passwordless Login module for Drupal (versions 0.0.0 to 5.4.1 and 5.5.0 to 5.5.2) is vulnerable to an information disclosure flaw via its headless login endpoint. The root cause is an insertion of sensitive information into sent data where the module returns ...
EUVD-2026-113568
Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful Browsing. This issue affects Two Factor Authentication - TFA / Passwordless Login versions: from 0.0.0 to 5.4.1, from 5.5.0 to 5.5.2...
CVE-2026-107267
The DKAN module for Drupal is vulnerable to a Missing Authorization vulnerability, which allows for Forceful Browsing . The issue arises because the module fails to correctly check access for all of its endpoints when exposing tabular data via a JSON API . This affects DKAN versions 0.0.0 to 4.0....
EUVD-2026-113567
Missing Authorization vulnerability in Drupal DKAN allows Forceful Browsing. This issue affects DKAN versions: from 0.0.0 to 4.0.4, from 4.1.0 to 4.1.5...
CVE-2026-107307
The SmartLinker AI module for Drupal (versions 0.0.0 to 1.0.3 ) is vulnerable to an Incorrect Authorization flaw (CWE-863) leading to Forceful Browsing . The root cause is that the module's "Generate internal links" search query fails to respect entity access when returning results to the browser...
EUVD-2026-113565
Incorrect Authorization vulnerability in Drupal SmartLinker AI allows Forceful Browsing. This issue affects SmartLinker AI versions: from 0.0.0 to 1.0.3...
CVE-2026-107309
The Easy Breadcrumb module for Drupal (versions 0.0.0 to 2.0.11 ) is susceptible to a Missing Authorization vulnerability. The root cause is that the module fails to sufficiently check for view access of parent terms before rendering a breadcrumb segment, which can allow Forceful Browsing and lea...