Drupal SAML SSO CVE-2026-87943

Requires a Drupal site running the SAML SSO - Service Provider module at a version below 3.2.0 (0.0.0 up to but not including 3.2.0). Exploitation is 'forceful browsing': an attacker directly requests a resource or endpoint whose authorization check is absent, so no authentication (PR:N), no user interaction (UI:N), and no special configuration are stated as required. Limiting factors: the attacker must know or discover the specific protected URL/resource, impact is confined to Low confidentiality and Low integrity (no availability effect), and the site must actually have the vulnerable module installed and enabled. The exact protected feature or path affected is not described in the available sources, so defenders should consult drupal.org/sa-contrib-2026-141 to scope which resources are exposed.

This is a moderate-severity (CVSS 6.5) missing-authorization flaw (CWE-862) in the Drupal 'SAML SSO - Service Provider' contributed module, with signals that point to low real-world urgency rather than an emergency. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N indicates a network-reachable, low-complexity, unauthenticated (PR:N) issue requiring no user interaction, but with only Low confidentiality and Low integrity impact and no availability impact. These severity signals are reinforced by weak exploitation signals: EPSS is 0.14% (3rd percentile), there is no CISA KEV listing, and no public exploit was identified at time of analysis. The vuln.today decision label is 'this_month' - a routine patch-cycle priority, not act_now or emergency. The signals are consistent with each other: a genuinely remote/unauthenticated weakness but low impact and no evidence of exploitation interest, so this is a patch-on-schedule item rather than a top-priority fire. Note the primary reference (drupal.org/sa-contrib-2026-141) could not be inspected here, so the precise affected feature is not confirmed from source text - the description only states 'Forceful Browsing' as the mechanism.

A remote, unauthenticated attacker directly requests a resource or page served by the SAML SSO - Service Provider module whose authorization check is missing, retrieving or altering content that should have been access-controlled (forceful browsing). Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials, special conditions, or victim interaction are needed, but impact is bounded to partial confidentiality and integrity. No public exploit code was identified at time of analysis.