Drupal Quick Tabs CVE-2026-73477

Exploitation requires the target Drupal site to have the Quick Tabs module installed and enabled at a version prior to 4.3.1, and at least one Quick Tabs instance must render content that is access-controlled (e.g., content visible only to authenticated users or specific Drupal roles). Sites using Quick Tabs exclusively for publicly accessible content have no confidentiality impact. No authentication, special tooling, or user interaction is required from the attacker. Exploitation is bounded to reading content surfaced by the Quick Tabs module - it does not provide write access, code execution, or lateral movement beyond the Drupal content layer.

The CVSS 5.3 Medium vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) accurately characterises a low-complexity, unauthenticated network attack yielding only low confidentiality impact. No EPSS score was supplied, the vulnerability is absent from CISA KEV, and no public proof-of-concept has been identified - all signals consistent with a lower real-world exploitation priority. The practical risk is context-dependent: sites using Quick Tabs solely for publicly visible content face negligible exposure, while sites that use the module to organise member-only, role-gated, or sensitive node content face meaningful information disclosure. The 'Authentication Bypass' tag applied in the input metadata is imprecise - CWE-863 describes an authorization bypass (access control failure post-authentication), not an authentication bypass (CWE-287, credential or session bypass). This distinction affects how defenders should prioritise the finding.

An unauthenticated attacker identifies a Drupal site running Quick Tabs and discovers a tab configured to display content restricted to authenticated users. By directly requesting the URL or endpoint that renders the tab - requiring no credentials, tools, or user interaction - the attacker retrieves private node content, restricted view results, or role-gated data that the module failed to protect.