EUVD-2026-113577
GHSA-49qr-j2v8-5wg8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Drupal site running Actstream
-
ExploitRequest protected activity-stream resource directly
-
ExecutionBypass authorization check (forceful browsing)
-
ImpactRead or modify unauthorized activity data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a target Drupal site running the Actstream contributed module at an affected version (0.0.0 up to but not including 2.0.1, or 2.1.0 up to but not including 2.1.1). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation is remote and unauthenticated with low complexity and no user interaction against affected installations. Limiting factors: the issue only affects sites with this specific module installed and unpatched; impact is bounded to Low confidentiality and Low integrity (no availability impact); and the exact resource or feature that must be reachable via forceful browsing is not specified in the available sources, so real-world exposure depends on which activity-stream functionality is enabled. |
| Impact | This is a moderate-severity, lower-priority issue rather than an emergency. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, 6.5 Medium) indicates a network-reachable, low-complexity flaw requiring no privileges (PR:N, so unauthenticated per available data) and no user interaction, with only Low confidentiality and Low integrity impact and no availability impact - consistent with an incorrect-authorization / forceful-browsing weakness (CWE-863) where an attacker reaches resources or actions they should not be authorized for. Countervailing signals strongly temper urgency: EPSS is only 0.14% (4th percentile), there is no CISA KEV listing (not confirmed actively exploited), and no public exploit or PoC reference is present in the input. The vuln.today decision label is 'this_month' (not act_now/emergency), and a vendor patch is available. The signals are internally consistent - a genuine but bounded authorization gap with limited impact, low probability of mass exploitation, and no evidence of weaponization - so it warrants scheduled remediation rather than crisis response. No conflicts between the CVSS vector and the description were observed. |
| Exploit ScenarioDerived | An unauthenticated remote attacker requests Actstream activity-stream resources or endpoints directly (forceful browsing), bypassing intended authorization checks to view or alter activity data they should not be able to access. No public exploit code or PoC reference is identified in the available data, and the specific endpoints/parameters abused are not described in the sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 30, 2026
Incorrect authorization in the Drupal Actstream contributed module lets remote unauthenticated visitors reach protected activity-stream resources through forceful browsing, yielding limited reads and modifications of data they should not be able to touch (CVSS 6.5, C:L/I:L/A:N). Sites running Actstream in the affected ranges - 0.0.0 up to but not including 2.0.1, and 2.1.0 up to but not including 2.1.1 - are exposed only if this contributed module is installed and unpatched; Drupal core is not implicated. No public exploit code has been identified at the time of analysis, EPSS is 0.14% (4th percentile), and the issue is not in CISA KEV, so this is a moderate-severity, lower-priority item rather than an emergency.
RemediationAI
The vendor has released a patch: upgrade Actstream to the first release outside each affected range (2.0.1 for the 2.0.x line and 2.1.1 for the 2.1.x line) as directed by Drupal SA-CONTRIB-2026-198 at https://www.drupal.org/sa-contrib-2026-198, then confirm the deployed module version is no longer inside the ranges 0.0.0-2.0.0 or 2.1.0. Because the exposure is confined to sites with this contributed module enabled, inventories that do not include Actstream can be deprioritized. No workaround is described in the available data, so the vendor advisory should be consulted for any interim guidance; until the upgrade is applied, affected activity-stream functionality remains reachable by unauthenticated remote visitors.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Actstream is a contributed Drupal module that supplies activity-stream functionality on top of Drupal's routing, controller and entity-access subsystems. The flaw is classified as CWE-863 (Incorrect Authorization): an access check on an Actstream-provided resource is missing or wrong, so an authorization decision that should deny the request instead permits it. The practical consequence is 'forceful browsing' - a visitor requests a path or route directly rather than reaching it through the intended UI navigation, and the improper check lets the request through. Per the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N vector, exploitation is remote, unauthenticated, low-complexity and requires no user interaction, with impact scoped to Low confidentiality and Low integrity and no availability effect; the CPE cpe:2.3:a:drupal:actstream:*:*:*:*:*:*:*:* confirms the affected component is the module itself rather than Drupal core. The trigger - which specific route, entity or operation must be requested - is not described in the available sources, so real-world exposure depends on which Actstream functionality a given site has enabled.
Know when Actstream gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Unauthenticated remote forceful-browsing authorization bypass (PR:N, AV:N, AC:L, no UI) yielding limited unauthorized read/write of activity data (C:L/I:L), no availability impact.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
4DescriptionCVE.org
Incorrect Authorization vulnerability in Drupal Actstream allows Forceful Browsing. This issue affects Actstream versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB