Drupal Advanced Search CVE-2026-84910

The target site must have the Drupal Advanced Search contrib module installed and enabled at a version below 2.4.5; the flaw is an authorization check that is absent on a search-related resource, letting a client reach it via forceful browsing (direct/guessed navigation) without the required permission. Limiting factors per the supplied CVSS vector: the attack requires user interaction (UI:R) and is high-complexity (AC:H), and impact is confined to Low confidentiality and Low integrity with no availability effect, so it does not grant full compromise. The exact resource, request, and reason for the UI/complexity requirements are not described in the available sources and should be confirmed against SA-contrib-2026-118.

This is a moderate-severity Missing Authorization flaw (CWE-862, 'Forceful Browsing') in the Drupal contrib module Advanced Search, with a vendor-assigned CVSS 3.1 score of 4.2 (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N). The vector indicates a network-reachable, unauthenticated (PR:N) weakness, but it is tempered by high attack complexity (AC:H) and a user-interaction requirement (UI:R), with only Low confidentiality and Low integrity impact and no availability impact. No EPSS score was supplied, the CVE is NOT in CISA KEV, and no proof-of-concept or exploit reference is present in the input - exploitation status is therefore 'no public exploit identified at time of analysis.' The vuln.today decision label is 'this_month' (routine remediation), which is consistent with the modest CVSS and absence of exploitation signals - this is a patch-in-normal-cycle issue, not an emergency. Note one internal inconsistency to verify with the vendor: the standard definition of forceful browsing (directly requesting a resource by guessing/navigating to its URL) does not obviously align with UI:R and AC:H in the supplied vector, and the Low integrity impact (I:L) is unusual for a read-oriented authorization bypass; the Drupal security advisory (SA-contrib-2026-118) should be consulted for the precise trigger. Overall: a real but low-urgency issue limited to sites running this specific contrib module.

A remote, unauthenticated attacker interacts with a Drupal site running Advanced Search (<2.4.5) and reaches a search-related resource or action that lacks a proper authorization check, viewing or influencing content they should not be permitted to access. Per the CVSS vector the attack is network-based but requires user interaction and has high complexity, and no public proof-of-concept is available at the time of analysis. The precise request/trigger is not described in the available sources.