Token Content Access CVE-2026-18259

The Token Content Access Drupal module must be installed and actively configured to restrict one or more content items using token-based access control - this is the module's core use case, so any standard deployment is affected. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, user interaction, or special attacker privilege is required. The primary practical limiting factor is network proximity: timing attacks require low and consistent round-trip latency to resolve sub-millisecond timing differences from background jitter; exploitation over high-latency or variable-latency internet paths (CDNs, shared hosting, cloud WAFs) is significantly impeded without a large volume of requests to average out noise. Rate limiting or WAF rules that detect high-frequency repeated requests to the same endpoint would further degrade attack feasibility without eliminating the root cause.

The NVD-assigned CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) is arguably generous in setting AC:L, since timing attacks against network services depend on environmental conditions - particularly round-trip latency variance - that are outside the attacker's direct control. Real-world risk signals are more conservative: EPSS sits at only 0.14% (4th percentile), SSVC reports exploitation status as 'none' with only partial technical impact, and there is no CISA KEV listing or known public exploit code. The SSVC 'Automatable: yes' flag is consistent with scriptable timing measurement but does not override the practical exploitation complexity. The net picture is a vulnerability worth patching promptly given a freely available vendor fix, but not one warranting emergency out-of-band remediation - the gap between the high CVSS score and the very low EPSS percentile reflects the realistic difficulty of extracting exploitable timing signal over commodity internet connections.

An unauthenticated attacker with low-latency network access to the target Drupal site writes a script to send thousands of HTTP requests to a token-validated content endpoint, systematically varying the submitted token value one byte at a time and recording server response times. By statistically aggregating timing measurements to filter out network noise, the attacker identifies which byte value at each position produces a marginally longer response (indicating a partial match), iterating through the token length until a fully valid token is reconstructed and protected content is accessed.