Description

Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*, from 0.0.0 to 11.2.*.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.2",
  "pubDate": "2026-08-25T23:16:56.320Z",
  "pubdate": "2026-08-25T23:16:56.320Z",
  "executiveSummary": "A critical Missing Authorization vulnerability exists within Drupal core, facilitating unauthorized access through Forceful Browsing.\nThe vulnerability stems from improper access control enforcement, which allows remote, unauthenticated, or low-privileged attackers to access restricted resources by navigating directly to unauthorized URLs.\nThe scope of affected versions includes Drupal core 0.0.0 to 10.6.13, 11.3.0 to 11.3.14, 11.4.0 to 11.4.4, and the 11.0.*, 11.1.*, and 11.2.* series.\nSuccessful exploitation allows an attacker to bypass intended security constraints, potentially leading to unauthorized data disclosure, administrative actions, or state changes within the application.\nThe impact is significant, as it undermines the core security boundary of the Drupal framework. No specific user interaction is required for an attacker to probe and exploit these unprotected endpoints.\nOrganizations using the specified versions of Drupal core are at risk and should prioritize remediation to prevent unauthorized system interaction.",
  "technicalDetails": "The identified vulnerability is categorized as a Missing Authorization flaw, specifically enabling Forceful Browsing attacks against the Drupal core framework.\nThe root cause involves a failure in the Drupal routing and access checking subsystems to consistently validate user permissions or roles when direct requests are made to specific application endpoints.\nIn a secure Drupal implementation, the AccessResultInterface and associated access checkers should govern all navigation; however, in the affected versions, certain paths fail to trigger these secondary authorization checks.\nAn attacker can execute this vulnerability by identifying reachable URL patterns that are intended to be restricted to administrative or authenticated users. By crafting specific GET or POST requests to these endpoints, an attacker can bypass the front-end or internal controller checks that would otherwise deny the request.\nThe attack flow proceeds as follows: First, the attacker performs reconnaissance to map the Drupal directory structure or specific administrative route patterns. Second, the attacker attempts to access these internal resources directly by traversing to the URI bypassing the standard UI-based workflow. Third, because the underlying application logic lacks the mandatory authorization header or session-based validation for these specific routes, the system processes the request as a legitimate user action, effectively granting access to protected data or administrative functionality.\nThis vulnerability is particularly concerning because it exposes internal resources that should be subject to strict Access Control Lists (ACLs). The lack of input validation regarding user privileges for these routes allows for vertical privilege escalation.\nPost-exploitation impact varies depending on the nature of the exposed endpoint; however, it generally results in the exposure of sensitive configuration data, unauthorized modification of site settings, or access to private user information stored within the database.\nThe vulnerability is persistent across multiple release branches, indicating a systemic issue in how routing integrity is maintained across different versions of the Drupal core architecture."
}