EUVD-2026-43063
GHSA-8375-8mwf-6r6x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify public Drupal site with WissKI installed
-
DeliveryEnumerate WissKI-registered Drupal routes via module docs or source
-
ExploitSend unauthenticated HTTP request to restricted WissKI endpoint
-
ExecutionMissing authorization check bypassed
-
ImpactAccess or manipulate restricted semantic/entity data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No authentication is required - the CVSS vector PR:N confirms unauthenticated access is sufficient. The vulnerability is present whenever the WissKI Drupal module (any version from 0.0.0 to 4.2.0) is installed and enabled on a Drupal site with network-accessible HTTP(S) endpoints. No special Drupal configuration or non-default settings are indicated as prerequisites. Exploitation is limited to sites that have WissKI installed; standard Drupal installations without this module are unaffected. The scope of accessible or modifiable data is bounded by what WissKI routes expose, with only partial confidentiality and integrity impact per CVSS (C:L/I:L), and no availability impact. |
| Impact | The CVSS 3.1 base score of 6.5 (Medium) is driven by network accessibility (AV:N), low complexity (AC:L), no required privileges (PR:N), and no user interaction (UI:N), with partial confidentiality and integrity impact but no availability impact. These metrics are internally consistent with a forceful browsing vulnerability. However, real-world risk signals significantly temper urgency: EPSS is 0.13% (3rd percentile), indicating very few similar vulnerabilities in this profile are being actively exploited; SSVC confirms exploitation status as 'none'; CISA KEV does not list this CVE; and no public proof-of-concept is identified. The SSVC 'Automatable: yes' flag is notable - once a target is identified, exploitation requires no manual effort - but the niche deployment footprint of WissKI dramatically limits the attacker-addressable surface. CVSS overstates urgency here relative to the negligible EPSS and absent exploitation signals; this is a patch-when-convenient finding for most organizations rather than an emergency. |
| Exploit ScenarioDerived | An unauthenticated attacker enumerates WissKI-specific Drupal route paths - discoverable through public documentation or module source inspection - and issues direct HTTP GET requests to restricted endpoints without holding the required permissions. The missing authorization check allows the server to respond with restricted entity or ontology data, or permits state-modifying actions, without the attacker ever authenticating. No public exploit code is identified at time of analysis, but the automatable nature means scripted scanning is straightforward. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 13, 2026
Missing authorization controls in Drupal WissKI versions prior to 4.2.0 enable unauthenticated remote attackers to perform forceful browsing - directly accessing restricted resources by guessing or enumerating URLs without undergoing proper authorization checks. The affected versions span the entire release history from 0.0.0 through 4.2.0, making all prior deployments vulnerable. SSVC assessment confirms no active exploitation at time of analysis, and the EPSS score of 0.13% (3rd percentile) suggests very low real-world exploitation probability despite the automatable nature of the attack.
RemediationAI
The vendor has released a patch; upgrade WissKI to version 4.2.0 or later by following the standard Drupal module update procedure (composer update drupal/wisski or via the Drupal admin interface). Full advisory details are available at https://www.drupal.org/sa-contrib-2026-059. If an immediate upgrade is not feasible, restrict access to the WissKI-served routes at the web server or reverse proxy layer by requiring authentication before requests reach the Drupal application - note this trade-off prevents legitimate public access if WissKI content is intended to be publicly browsable. Additionally, reviewing and tightening Drupal route-level permissions via the permissions UI for WissKI-registered routes may reduce exposure until the patch is applied.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WissKI (Wissenschaftliche Kommunikations-Infrastruktur) is a Drupal contributed module providing a semantic web-based content management framework, primarily used by cultural heritage institutions and digital humanities projects for structured knowledge representation via RDF/OWL ontologies. The root cause is CWE-862 (Missing Authorization) - the module fails to enforce access control checks on one or more routes or callbacks, allowing direct HTTP requests to bypass the authorization layer entirely. This is a classic forceful browsing pattern where protected resources are reachable by constructing or guessing their URLs without holding the required permissions. The affected CPE is cpe:2.3:a:drupal:wisski:*:*:*:*:*:*:*:*, confirming all WissKI versions prior to 4.2.0 as vulnerable per the EUVD-2026-43063 entry.
Know when Wisski gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Forceful browsing over network with no auth or interaction; partial C and I only, no availability impact, no scope change.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
6DescriptionCVE.org
Missing Authorization vulnerability in Drupal WissKI allows Forceful Browsing. This issue affects WissKI versions: from 0.0.0 to 4.2.0.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB