EUVD-2026-69989
GHSA-4j22-v3g2-gfc3
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Unauthenticated HTTP forceful browsing (AV:N/AC:L/PR:N/UI:N) with read-only confidentiality impact bounded to tab-surfaced content (C:L/I:N/A:N), no scope change.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
5DescriptionCVE.org
Incorrect Authorization vulnerability in Drupal Quick Tabs allows Forceful Browsing. This issue affects Quick Tabs versions: from 0.0.0 to 4.3.1.
AnalysisAI
Incorrect authorization in the Drupal Quick Tabs contributed module (all versions prior to 4.3.1) permits unauthenticated remote users to perform forceful browsing against tab-rendered content that should be access-restricted. The CVSS 5.3 Medium score reflects a confidentiality-only impact - no integrity or availability compromise is possible - and actual risk scales with whether the affected site uses Quick Tabs to surface access-controlled content such as private nodes or role-restricted views. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target Drupal site to have the Quick Tabs module installed and enabled at a version prior to 4.3.1, and at least one Quick Tabs instance must render content that is access-controlled (e.g., content visible only to authenticated users or specific Drupal roles). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.3 Medium vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) accurately characterises a low-complexity, unauthenticated network attack yielding only low confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Drupal Quick Tabs to version 4.3.1 or later, which resolves the incorrect authorization check per the Drupal security advisory at https://www.drupal.org/sa-contrib-2026-099. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-863 – Incorrect Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today