Drupal PanKM CVE-2026-16646

Exploitation requires the PanKM Drupal contributed module to be installed and enabled on the target site. The CVSS vector specifies PR:H (high privileges required), meaning the attacker must already control a high-privilege Drupal account on the target instance. UI:R (user interaction required) further constrains exploitation: a legitimate user must take an action-such as visiting a crafted URL or clicking a link-making fully automated or hands-off exploitation impossible (SSVC automatable: no). The exploitable condition itself is a missing authentication check (CWE-306) on a specific critical PanKM function; the exact route or callback is not identified in available data but is confirmed by the vendor advisory. Exploitation is limited by: (1) attacker must possess a high-privilege Drupal account, (2) active victim user interaction is required and cannot be automated, (3) the module must be installed and active, and (4) AC:H indicates additional complexity constraints beyond baseline access.

The CVSS 3.1 base score of 5.7 (Medium) accurately reflects the real-world constraint stack: high attack complexity (AC:H), high privileges required (PR:H), and mandatory user interaction (UI:R) collectively make opportunistic or automated exploitation very unlikely, consistent with the EPSS score of 0.14% (4th percentile) and the SSVC determination of automatable: no. However, a notable analytical inconsistency exists between the Authentication Bypass tag and CWE-306 classification on one hand and the PR:H metric on the other - classic authentication-bypass flaws typically carry lower privilege requirements, so this pairing suggests either that the bypass enables a high-privilege account to access functions beyond its intended authorization scope, or that PR:H reflects the need to reach the vulnerable endpoint from an authenticated session before the missing check can be exploited. SSVC rates technical impact as total, aligning with C:H/I:H in the CVSS vector and indicating that successful exploitation could fully compromise confidentiality and integrity within the module's scope - a meaningful concern for organizations storing sensitive knowledge-base content in PanKM. The absence of confirmed exploitation, a sub-1% EPSS, and the multiple constraint layers make this a low-urgency but non-trivial finding: organizations with sensitive data in PanKM should patch upon advisory guidance rather than treating this as an emergency.

An attacker holding a high-privilege Drupal account on a site running PanKM crafts a request targeting a critical module function that omits the expected authentication check, and induces a victim user to interact (such as clicking a crafted link or visiting a specific URL) to satisfy the UI:R requirement. Once the missing authentication gate is bypassed, the attacker gains unauthorized read or write access to sensitive knowledge-management content. No public exploit code has been identified at time of analysis.