CVE-2026-1553

The Drupal Canvas module (versions prior to 1.0.4 ) contains an incorrect authorization vulnerability that allows forceful browsing of Canvas Pages. The root cause is that the module does not sufficiently validate access to pages that have been unpublished. While the risk is mitigated by the fact...