Drupal DKAN CVE-2026-107267

No special conditions beyond reachability - per CVSS PR:N/UI:N this is remote unauthenticated exploitation of DKAN (Drupal open-data module) versions 0.0.0 through <4.0.4 and 4.1.0 through <4.1.5, requiring only the ability to send requests to the application. The attacker directly accesses resources whose authorization check is missing (forceful browsing); the specific protected feature or endpoint affected is not described in the available sources. LIMITING FACTORS: impact is confined to limited information disclosure (C:L, no integrity or availability impact), the instance must be network-reachable to the attacker, and the deployment must run an unpatched affected version - updating to 4.0.4 or 4.1.5 remediates it.

Signals are consistent and point to a genuine but low-urgency issue rather than a top-priority emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes trivial remote, unauthenticated, no-interaction access, which inflates the base score, but impact is confined to C:L with I:N and A:N - i.e. limited unauthorized disclosure only, no data modification or outage. The EPSS score is very low (0.14%, 4th percentile), the CVE is NOT on CISA KEV, and no exploit code is referenced, so there is no evidence of active or imminent mass exploitation. The vuln.today decision label is 'this_month', aligning with a moderate, scheduled-remediation posture rather than act_now/emergency. Net: a real missing-authorization (forceful browsing) flaw that is easy to trigger but low in consequence; patch within the normal monthly cycle, prioritizing internet-exposed DKAN portals. Note that the specific resources/endpoints left unprotected are not enumerated in the available sources, so the true confidentiality impact of a given deployment should be verified against the Drupal advisory.

A remote, unauthenticated attacker directly requests DKAN URLs or API endpoints that are missing authorization checks (forceful browsing), retrieving records or resources that should have been access-restricted. Because the flaw requires no authentication, no user interaction, and low complexity, enumeration is straightforward, but disclosure is limited (CVSS C:L) and no modification or denial of service is possible. No public exploit identified at time of analysis.