Digital Signage Framework
Monthly
Unauthenticated forceful browsing in Drupal's Digital Signage Framework (versions 0.0.0 through 2.6.0) exposes restricted module endpoints without any authorization check, allowing remote attackers to read content or configuration data that Drupal's permission system was intended to protect. The root cause is CWE-862 (Missing Authorization) - affected URL routes are served without verifying the requester's Drupal role or permission grants. Drupal issued SA-contrib-2026-109 and released version 2.6.1 as the fix; no active exploitation or public proof-of-concept code has been identified at time of analysis.
Unauthenticated forceful browsing in Drupal's Digital Signage Framework (versions 0.0.0 through 2.6.0) exposes restricted module endpoints without any authorization check, allowing remote attackers to read content or configuration data that Drupal's permission system was intended to protect. The root cause is CWE-862 (Missing Authorization) - affected URL routes are served without verifying the requester's Drupal role or permission grants. Drupal issued SA-contrib-2026-109 and released version 2.6.1 as the fix; no active exploitation or public proof-of-concept code has been identified at time of analysis.