EUVD-2026-113579
GHSA-9qcq-j447-mmpr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as high-privileged Drupal user
-
ExploitSend crafted request to Orphans Media
-
ExecutionTrigger disclosure/integrity flaw
-
ImpactExfiltrate or alter sensitive data
Vulnerability Assessment
| Exploitation Conditions | Exploitation requires a high-privileged authenticated account on a Drupal installation that has the Orphans Media contrib module enabled (PR:H), limiting the attacker population to trusted/administrative users. Attack complexity is high (AC:H), indicating success depends on conditions outside the attacker's direct control, further reducing reliability. The specific feature, request, or configuration that triggers the flaw is not described in the available sources - the CVE description contains no technical detail and lists affected versions only as '*.*', so the precise prerequisite and the fixed version must be obtained from Drupal advisory SA-contrib-2026-196. |
| Impact | This is a moderate-severity, non-emergency issue (CVSS 5.9). The CVSS vector CVSS:3.1/AV:N/AC:H/PR:H/UI:N indicates a network-reachable flaw that nonetheless requires high privileges (PR:H) and has high attack complexity (AC:H), both of which significantly constrain real-world exploitability. Confidence in automated exploitation is low: EPSS is 0.14% (3rd percentile), the CVE is NOT on CISA KEV, and no public exploit was identified at time of analysis. These signals align - low EPSS, no KEV, no PoC, high privilege requirement - and all point to this being a genuinely lower-priority issue rather than a high-CVSS-but-urgent one. The vuln.today decision label is 'this_month', consistent with scheduled patching rather than emergency response. One internal inconsistency to verify: the CVSS claims C:H/I:H (high confidentiality AND integrity impact), yet the only categorization tag is 'Information Disclosure', which implies confidentiality impact only - the integrity component (I:H) is not corroborated by the tag or the (effectively empty) description, so the true impact scope should be confirmed against the Drupal advisory SA-contrib-2026-196. |
| Exploit ScenarioDerived | An attacker who already holds a high-privileged authenticated account on a Drupal site running the Orphans Media module sends crafted requests over the network to trigger the flaw, obtaining access to sensitive data (and, per the CVSS integrity metric, potentially altering it). The high attack complexity (AC:H) means exploitation is not reliably repeatable and likely depends on conditions not controllable by the attacker. No public exploit was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 30, 2026
The Orphans Media contributed module for Drupal is affected across all versions ('*.*') by a high-complexity flaw that a highly privileged authenticated user could leverage to compromise confidentiality and integrity; the module's function, trigger, and fix are documented in Drupal advisory SA-contrib-2026-196 rather than the CVE record. EPSS is negligible (0.14%, 3rd percentile) and there is no KEV entry or public exploit reference, so this is a moderate, non-emergency issue (CVSS 5.9, decision label 'this_month') whose real exposure is limited to sites that installed this contrib module and grant administrative-level accounts. The vulnerability yields no availability impact (C:N? no - A:N), and exploitation depends on conditions outside the attacker's control (AC:H).
RemediationAI
Consult Drupal advisory SA-contrib-2026-196 (https://www.drupal.org/sa-contrib-2026-196) for the vendor-released fixed release and update the Orphans Media module to that version; the supplied intelligence does not state an explicit fix version, so the exact number must be taken from that advisory rather than assumed. Because the flaw requires a high-privileged authenticated account and high attack complexity, a practical interim control is to restrict administrative and other highly privileged Drupal roles to a small, trusted set of accounts and to review which users hold permissions related to this module, accepting that this limits but does not eliminate exposure. Sites that cannot update promptly and do not depend on the module's functionality can disable or uninstall Orphans Media, which removes the attack surface at the cost of losing its media-cleanup behavior, and this trade-off should be weighed against the moderate severity and negligible EPSS score (0.14%). Monitor the Drupal advisory page for the patched release and for any vendor-provided workaround guidance; there is no KEV entry or public exploit reference at time of analysis, so exploitation is not confirmed as active.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in composer
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Drupal's contributed module ecosystem ships separately from Drupal core, and CPE data (cpe:2.3:a:drupal:orphans_media:*:*:*:*:*:*:*:*) confirms the entire version range of the 'Orphans Media' project is in scope, matching the EUVD note of affected versions '*.*'. The root-cause class is not classified in the supplied data (CWE: N/A) and the CVE text contains no technical detail, so the precise mechanism - what request, feature, or configuration triggers the flaw - is not described in the available sources and must be read from the Drupal advisory. The assessed vector CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N indicates a network-reachable defect that requires a high-privileged authenticated account (PR:H) and depends on conditions outside the attacker's direct control (AC:H), with high confidentiality and integrity impact but none to availability, all confined to the module's own security scope (S:U). Because the flaw lives in a contrib module rather than core, the affected population is self-selected: only sites that installed Orphans Media and expose privileged Drupal roles to potential abusers carry the risk described.
Know when Orphans Media gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
Network-reachable but requires a high-privileged account (PR:H) and has uncontrollable trigger conditions (AC:H); impact retained as C:H/I:H/A:N per input as the empty description gives no basis to lower it.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in Drupal Orphans Media. This issue affects Orphans Media versions: *.*.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB