Drupal Gutenberg CVE-2026-107263

Exploitation requires the Drupal Gutenberg module to be installed and enabled, and the attacker must hold a valid authenticated account on the site (CVSS PR:L), so this is not exploitable by fully anonymous users. The affected code paths are in Gutenberg versions 0.0.0 through 2.15.0 and 3.0.0 through 3.0.7; sites on fixed releases are not affected. The specific feature, route, or configuration that exposes the mis-authorized resource is not described in the available sources, so the exact restricted endpoint subject to forceful browsing cannot be named from the provided data. Limiting factors: required low-privilege authentication and the need for the optional contrib module to be deployed; no user interaction is required (UI:N).

This is a moderate-severity access-control flaw (CVSS 5.4) that signals real but non-urgent risk. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N indicates a network-reachable, low-complexity issue requiring some authenticated privilege (PR:L), with limited confidentiality and integrity impact and no availability impact (C:L/I:L/A:N). The signals are consistent and point toward a low-urgency item: EPSS is just 0.14% (4th percentile), indicating very low probability of exploitation in the wild; the CVE is NOT on CISA KEV, so there is no confirmed active exploitation; and no exploit or PoC reference is present in the input. The vuln.today decision label is 'this_month,' aligning with a 'patch in routine cycle' posture rather than emergency. The PR:L requirement means an attacker needs a valid (if low-privileged) Drupal account, which materially limits mass exploitation. Net: this is a legitimate authorization weakness worth patching on a normal maintenance cadence, not a high-CVSS-but-illusory issue, but neither is it an emergency. No SSVC exploitation/automatable/technical-impact breakdown was supplied, so that framework could not be cross-referenced.

An attacker who holds a low-privileged authenticated account on a Drupal site running the Gutenberg module directly requests (forcefully browses to) a URL or resource endpoint that should be access-restricted. Because authorization is enforced incorrectly, the attacker views or modifies content they should not be able to reach. No public exploit identified at time of analysis, and remote access over the network is possible with low attack complexity but requires valid credentials.