EUVD-2026-69992
GHSA-ghfg-j64w-r9hj
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Unauthenticated network access confirmed by PR:N; impact is read-only confidentiality of diff content with no integrity or availability effect.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
5DescriptionCVE.org
Incorrect Authorization vulnerability in Drupal Diff allows Forceful Browsing. This issue affects Diff versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1.
AnalysisAI
Incorrect Authorization (CWE-863) in the Drupal Diff contributed module allows unauthenticated remote users to perform Forceful Browsing against revision comparison endpoints that should be access-controlled, resulting in limited confidentiality exposure of content diff data. Affected versions span Diff 0.0.0-<2.0.1 and 2.1.0-<2.1.1; a vendor-released patch is available via Drupal Security Advisory SA-Contrib-2026-096. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The Drupal Diff contributed module must be installed and enabled on the target site - it is not part of Drupal core, so sites that have never installed it are unaffected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The Medium CVSS score of 5.3 accurately reflects a bounded real-world risk: the flaw leaks revision diff content but confers no write or administrative capability (I:N, A:N), and scope is unchanged (S:U), so lateral movement or privilege escalation is not directly enabled by this vulnerability alone. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to update the Drupal Diff module to a patched release per the vendor advisory at https://www.drupal.org/sa-contrib-2026-096. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-863 – Incorrect Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today