What is the CVSS score of CVE-2026-13232?

CVE-2026-13232 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-13232?

Yes, a patch is available for CVE-2026-13232. Update the affected software to the latest version immediately.

Advanced Content Feedback CVE-2026-13232

EUVD-2026-43056 LOW

Incorrect Authorization (CWE-863)

2026-07-10 drupal

GHSA-6xj8-mcp3-72g6

Authentication Bypass Drupal Advanced Content Feedback Aka Admin Feedback

3.1

CVSS 3.1 · Vendor: drupal

Severity by source

Vendor (drupal) PRIMARY

3.1 LOW

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

3.1 LOW

Network-accessible Drupal module; low privileges required for authenticated session; high complexity for path enumeration; integrity-only, limited impact, no scope change.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (drupal).

CVSS VectorVendor: drupal

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 21:16 vuln.today

Severity Changed

Jul 13, 2026 - 19:22 NVD

CRITICAL LOW

CVSS changed

Jul 13, 2026 - 19:22 NVD

9.8 (CRITICAL) 3.1 (LOW)

CVSS changed

Jul 13, 2026 - 19:07 NVD

9.8 (CRITICAL)

Patch available

Jul 10, 2026 - 23:02 EUVD

CVE Published

Jul 10, 2026 - 21:44 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Incorrect Authorization vulnerability in Drupal Advanced Content Feedback (aka admin_feedback) allows Forceful Browsing. This issue affects Advanced Content Feedback (aka admin_feedback) versions: from 0.0.0 to 2.8.0.

AnalysisAI

Incorrect authorization in the Drupal Advanced Content Feedback (admin_feedback) contributed module allows authenticated low-privilege users to perform forceful browsing, accessing restricted feedback resources without proper authorization checks. All module releases from 0.0.0 up to (but not including) 2.8.0 are affected. No public exploit code exists and no active exploitation has been identified; EPSS sits at the 4th percentile, consistent with the SSVC assessment of zero current exploitation.

Technical ContextAI

CWE-863 (Incorrect Authorization) describes a failure to enforce access controls after authentication - the module either omits authorization gate checks on certain URL paths or applies them inconsistently, enabling forceful browsing (directly navigating to nominally restricted endpoints). The affected component is a Drupal 9/10 contributed module (CPE cpe:2.3:a:drupal:advanced_content_feedback_(aka_admin_feedback):*:*:*:*:*:*:*:*) that provides inline content-feedback widgets and administrative interfaces, typically surfacing admin-only feedback dashboards. The root cause class - missing or mis-applied hook_access / access-check callbacks in Drupal's routing layer - allows a node of the content feedback system to be traversed without the expected privilege assertion.

RemediationAI

Upgrade the Advanced Content Feedback (admin_feedback) Drupal module to version 2.8.0 or later, as detailed in the Drupal security advisory SA-CONTRIB-2026-052 at https://www.drupal.org/sa-contrib-2026-052. The vendor has confirmed a patch is available. Sites unable to upgrade immediately should consider temporarily disabling the module via the Drupal Extend page (admin/modules) - this removes the attack surface entirely at the cost of losing feedback widget functionality. Alternatively, restricting access to feedback-related routes via Drupal's router or web-server-level path blocking (e.g., denying access to the module's admin paths in nginx or Apache config) can reduce exposure, though this approach requires knowledge of exact route paths and does not address the underlying authorization flaw. Disabling the module is the lower-risk interim workaround.