EUVD-2026-43090
GHSA-m6q8-j665-f2qg
Severity by source
AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
Network delivery confirmed, but AC:H and PR:H reflect complex conditions and required high-privilege Drupal access; no availability impact per module scope.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
2DescriptionCVE.org
vulnerability in Drupal Clean RESTful allows . This issue affects Clean RESTful versions: *.*.
AnalysisAI
Authentication bypass in the Drupal Clean RESTful contributed module (cpe:2.3:a:drupal:clean_restful:*:*:*:*:*:*:*:*) enables network-reachable attackers with high existing privileges to circumvent authentication controls exposed via the module's REST API endpoints, resulting in high confidentiality and integrity impact against the Drupal application. All versioned releases of the module are affected per the wildcard CPE. No public exploit code has been identified at time of analysis, and CISA has not added this vulnerability to the Known Exploited Vulnerabilities catalog, though SSVC rates the technical impact as total.
Technical ContextAI
Clean RESTful is a Drupal contributed module that provides RESTful web service interfaces on top of Drupal's entity and content systems. The root cause is CWE-287 (Improper Authentication), meaning the module fails to correctly verify the identity or authorization state of callers when processing REST API requests. The CPE string cpe:2.3:a:drupal:clean_restful:*:*:*:*:*:*:*:* covers every release of the module without a safe floor, indicating the flaw is architectural or present across the module's entire development history. The CVSS vector AV:N/AC:H reflects that the exploit is network-delivered but requires complex conditions to trigger - likely a specific API endpoint, request structure, or configuration state. PR:H is notable for an authentication bypass class flaw: it suggests the bypass may require the attacker to already hold high-privilege Drupal credentials (such as an administrator role) in order to manipulate an authentication decision - rather than enabling an unauthenticated actor to gain access. The S:U scope indicates the impact is contained within the Drupal installation itself.
RemediationAI
The primary remediation is to apply the update released by the Drupal Security Team as documented in security advisory SA-CONTRIB-2026-078 at https://www.drupal.org/sa-contrib-2026-078. No specific fixed version number is identifiable from the provided input data, so administrators must consult that advisory directly to determine the patched release and upgrade accordingly using Drupal's standard module update workflow (e.g., 'composer update drupal/clean_restful' or Drush). As a compensating control while patching is scheduled, consider temporarily disabling the Clean RESTful module entirely via the Drupal admin interface (Extend > Clean RESTful > Uninstall) if REST API functionality is non-essential - this eliminates the attack surface at the cost of any dependent API integrations. If the module cannot be disabled, restrict network access to REST API endpoints exposed by the module at the web server or firewall layer, limiting access to known, trusted IP ranges only. Review Drupal's access control settings for REST resources to ensure no anonymous or low-privilege roles have been granted REST API permissions beyond what is required.
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today