EUVD-2026-113563
GHSA-8hqq-wrgf-qc4g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Drupal site using Easy Breadcrumb
-
ExploitRequest unauthorized breadcrumb resource
-
ExecutionBypass missing authorization check
-
ImpactRead restricted content metadata
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The CVE describes a Missing Authorization flaw in the Easy Breadcrumb Drupal module that permits Forceful Browsing in versions 0.0.0 through before 2.0.11; the specific feature, path, or configuration that must be reachable to trigger it is not described in the available sources. Per CVSS, exploitation is remote and requires no authentication or user interaction (AV:N, PR:N, UI:N) but is rated high complexity (AC:H), which the evidence does not explain, so some non-trivial or situational condition is implied but unverified. Exploitation is limited to low-impact information disclosure only (C:L, I:N, A:N), and the prerequisite is that a target site runs Easy Breadcrumb at a version below 2.0.11. |
| Impact | This is a low-severity issue (CVSS 3.7) and the combined signals point to low real-world priority rather than an urgent threat. The CVSS vector is network-reachable and unauthenticated (AV:N, PR:N, UI:N) but carries high attack complexity (AC:H), unchanged scope (S:U) and only low confidentiality impact (C:L) with no integrity or availability effect - consistent with a Missing Authorization (CWE-862) flaw enabling forceful browsing, i.e. unauthorized read access to resources rather than code execution. The EPSS score is very low (0.14%, 4th percentile), the SSVC framework reports Exploitation: none, Automatable: no, and Technical Impact: partial, and the vuln.today Decision label is 'monitor' - all mutually reinforcing a non-urgent posture. The CVE is not listed in CISA KEV. No conflicting signals of note; the one point to verify is the AC:H rating, because forceful browsing (simply requesting resources) is often low-complexity, yet none of the supplied sources describe the actual trigger, so the vendor's AC:H cannot be explained from the evidence. Patch availability is confirmed (vendor advisory sa-contrib-2026-212), so remediation is straightforward. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker requests breadcrumb-related resources or paths that the Easy Breadcrumb module fails to authorize, allowing them to read information (such as titles or paths of access-restricted or unpublished Drupal content) that should be hidden. The exact trigger is not described in the available sources, and no public exploit code or PoC reference is provided. Impact is limited to low confidentiality disclosure with no modification or disruption of the site. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 30, 2026
Missing authorization checks in the Drupal contributed module Easy Breadcrumb (versions 0.0.0 through 2.0.11) allow a remote unauthenticated visitor to reach resources by directly requesting them rather than following the intended navigation path, a forceful-browsing condition whose confirmed impact is limited to low-severity information disclosure (CVSS 3.7). There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, and the EPSS score of 0.14% (4th percentile) plus an SSVC posture of exploitation:none / automatable:no place this in a monitor-and-schedule band rather than an emergency. The vendor has released a patch, so sites running the affected range should update the module.
RemediationAI
Update the Easy Breadcrumb module to version 2.0.11 or later, which is the vendor-released patch for this advisory (SA-CONTRIB-2026-212, https://www.drupal.org/sa-contrib-2026-212); the standard Drupal contrib upgrade path via Composer (composer update drupal/easy_breadcrumb) or the module's update workflow applies, and a database update should be run if the release includes one. Vendor-released patch: 2.0.11. Because the exploitation preconditions are not fully described in the available sources, the practical interim measure is to confirm whether the module is actually needed on the site and, if it is not, uninstall it - uninstalling removes the affected routes entirely but will change breadcrumb output on existing pages. Where the module must stay in place temporarily, restrict the exposed paths through the site's access-control layer or a reverse-proxy rule until the update is deployed, accepting that this may break legitimate breadcrumb rendering for some pages. No vendor workaround beyond updating is described in the supplied sources, and the low EPSS score, lack of KEV listing and 'monitor' decision label mean the upgrade should be scheduled with normal maintenance rather than treated as an emergency.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Easy Breadcrumb is a Drupal contributed module that generates and exposes breadcrumb data for site pages, so it registers routes and page callbacks that respond to HTTP requests. The flaw is classified CWE-862 (Missing Authorization): an access-control check is absent from the affected code path, which in Drupal terms typically means a route or controller lacks the permission or entity-access requirement that should gate it. That gap is what enables 'forceful browsing' - an attacker requesting URLs directly instead of navigating to them and thereby reaching a page or data set their role should not expose. CPE data (cpe:2.3:a:drupal:easy_breadcrumb) confirms the affected component is the module itself rather than Drupal core, and EUVD lists the affected range as all versions below 2.0.11. Per the assessed vector the issue is remotely reachable with no authentication and no user interaction, with impact limited to confidentiality (C:L, I:N, A:N); the specific feature, path, or configuration that must be reachable to trigger the missing check is not described in the available sources, and the high complexity rating applied in the vendor vector is likewise not explained by the evidence. Note that the accompanying tags label this an authentication bypass, but the missing check yields disclosure of otherwise-restricted content rather than a session or privilege escalation.
Know when Easy Breadcrumb gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Forceful browsing via missing authorization is remote and unauthenticated with only low confidentiality disclosure; AC set to L as resource access is typically low-complexity, though the vendor rated AC:H and no source describes the trigger.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
3DescriptionCVE.org
Missing Authorization vulnerability in Drupal Easy Breadcrumb allows Forceful Browsing. This issue affects Easy Breadcrumb versions: from 0.0.0 to 2.0.11.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB