EUVD-2026-43050
GHSA-q6w5-4q59-rj5q
Severity by source
AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
Network-accessible Drupal route but PR:H required (elevated session prerequisite) and AC:H reflects non-trivial path enumeration; no availability impact applies.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
6DescriptionCVE.org
Missing Authorization vulnerability in Drupal Examples for Developers allows Forceful Browsing. This issue affects Examples for Developers versions: from 0.0.0 to 4.0.6.
AnalysisAI
Missing Authorization in Drupal's Examples for Developers module (versions 0.0.0 through 4.0.5) permits forceful browsing by an already highly-privileged authenticated attacker, exposing restricted paths with limited confidentiality and integrity impact. All available signals converge on minimal real-world risk: CVSS scores 3.3 (Low), EPSS sits at 0.14% (4th percentile), SSVC reports no known exploitation and non-automatable attack conditions, and neither active exploitation nor public proof-of-concept code has been identified. A vendor patch is available at version 4.0.6.
Technical ContextAI
CWE-862 (Missing Authorization) describes a failure to verify that the requesting principal is authorized to access a specific resource before granting access, distinct from authentication failures. In the Drupal ecosystem, this manifests as a contributed module omitting access checks on menu callbacks or route definitions, enabling direct URL traversal (forceful browsing) to otherwise restricted content. The affected product is the Drupal contributed module 'Examples for Developers' (CPE: cpe:2.3:a:drupal:examples_for_developers:*:*:*:*:*:*:*:*), which is a developer reference and teaching module designed to demonstrate Drupal coding patterns - it is not intended for production deployment. The attack vector is network-based (AV:N), consistent with a web-accessible Drupal route lacking an access callback.
RemediationAI
Update the Examples for Developers Drupal module to version 4.0.6 or later, as confirmed by the affected version range in EUVD-2026-43050 and the vendor advisory at https://www.drupal.org/sa-contrib-2026-044. Given this module is explicitly a developer reference tool and not intended for production environments, the most effective remediation for production sites is to uninstall and remove the module entirely - this eliminates the attack surface with no functional trade-off for production workloads. If the module must remain enabled in a development or staging context, restrict Drupal administrative role assignments to minimize the population of accounts meeting the PR:H prerequisite. No workarounds independent of patching or removal have been identified in available references.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today