Drupal Smart Content CVE-2026-96386

Exploitation requires the Smart Content contrib module installed on a Drupal site at a version in the 0.0.0-3.2.1 range, where a code path performs no authorization check and permits forceful browsing to a restricted resource; the specific endpoint, feature, or route involved is not described in the available sources. Impact is limited by the CVSS scoring to low confidentiality and low integrity with no availability effect, so unauthorized access is partial rather than total. The NVD vector marks UI:R (user interaction required), but the sources do not describe any interaction step in a forceful-browsing scenario, so this limiting factor is unverified and should be confirmed with the vendor advisory.

Signals point to a moderate, not urgent, priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N, base 5.4) indicates a network-reachable, low-complexity, unauthenticated flaw with only low confidentiality and integrity impact and no availability impact, consistent with CWE-862 Missing Authorization enabling forceful browsing. No EPSS score, no CISA KEV entry, and no proof-of-concept are present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The vuln.today decision label is 'this_month', aligning with a patch-when-convenient cadence rather than emergency action. One internal tension to verify with the vendor: the NVD vector asserts UI:R (user interaction required), yet a Missing-Authorization/forceful-browsing weakness normally needs no victim interaction - an attacker requests the restricted resource directly - so the UI:R scoring is not explained by the available sources and may understate reachability. The real-world priority is further bounded by the affected software being a specific Drupal contrib module rather than Drupal core.

A remote attacker enumerates and directly requests Smart Content resources or endpoints on a Drupal site running a vulnerable version (through 3.2.1) where the module fails to enforce an authorization check, thereby reaching content that should be access-restricted. Because the impact is rated low for both confidentiality and integrity, the attacker gains limited unauthorized read and/or modify access rather than full compromise. No public exploit code is identified in the sources, so exploitation would rely on manually crafted requests.