What is the CVSS score of CVE-2026-13239?

CVE-2026-13239 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-13239?

Yes, a patch is available for CVE-2026-13239. Update the affected software to the latest version immediately.

Drupal WissKI CVE-2026-13239

EUVD-2026-43063 MEDIUM

Missing Authorization (CWE-862)

2026-07-10 drupal

GHSA-8375-8mwf-6r6x

Authentication Bypass Drupal Wisski

6.5

CVSS 3.1 · Vendor: drupal

Severity by source

Vendor (drupal) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

6.5 MEDIUM

Forceful browsing over network with no auth or interaction; partial C and I only, no availability impact, no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (drupal).

CVSS VectorVendor: drupal

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 21:18 vuln.today

Severity Changed

Jul 13, 2026 - 19:22 NVD

CRITICAL MEDIUM

CVSS changed

Jul 13, 2026 - 19:22 NVD

9.8 (CRITICAL) 6.5 (MEDIUM)

CVSS changed

Jul 13, 2026 - 19:07 NVD

9.8 (CRITICAL)

Patch available

Jul 10, 2026 - 23:02 EUVD

CVE Published

Jul 10, 2026 - 21:44 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 10, 2026 - 21:44 cve.org

MEDIUM 6.5

DescriptionCVE.org

Missing Authorization vulnerability in Drupal WissKI allows Forceful Browsing. This issue affects WissKI versions: from 0.0.0 to 4.2.0.

AnalysisAI

Missing authorization controls in Drupal WissKI versions prior to 4.2.0 enable unauthenticated remote attackers to perform forceful browsing - directly accessing restricted resources by guessing or enumerating URLs without undergoing proper authorization checks. The affected versions span the entire release history from 0.0.0 through 4.2.0, making all prior deployments vulnerable. SSVC assessment confirms no active exploitation at time of analysis, and the EPSS score of 0.13% (3rd percentile) suggests very low real-world exploitation probability despite the automatable nature of the attack.

Technical ContextAI

WissKI (Wissenschaftliche Kommunikations-Infrastruktur) is a Drupal contributed module providing a semantic web-based content management framework, primarily used by cultural heritage institutions and digital humanities projects for structured knowledge representation via RDF/OWL ontologies. The root cause is CWE-862 (Missing Authorization) - the module fails to enforce access control checks on one or more routes or callbacks, allowing direct HTTP requests to bypass the authorization layer entirely. This is a classic forceful browsing pattern where protected resources are reachable by constructing or guessing their URLs without holding the required permissions. The affected CPE is cpe:2.3:a:drupal:wisski:*:*:*:*:*:*:*:*, confirming all WissKI versions prior to 4.2.0 as vulnerable per the EUVD-2026-43063 entry.

RemediationAI

The vendor has released a patch; upgrade WissKI to version 4.2.0 or later by following the standard Drupal module update procedure (composer update drupal/wisski or via the Drupal admin interface). Full advisory details are available at https://www.drupal.org/sa-contrib-2026-059. If an immediate upgrade is not feasible, restrict access to the WissKI-served routes at the web server or reverse proxy layer by requiring authentication before requests reach the Drupal application - note this trade-off prevents legitimate public access if WissKI content is intended to be publicly browsable. Additionally, reviewing and tightening Drupal route-level permissions via the permissions UI for WissKI-registered routes may reduce exposure until the patch is applied.