Live › vulnerability › CVE-2026-107255
The Drupal Restrict route by IP module has an incorrect authorization flaw that lets a visitor reach routes the IP restriction should block. An attacker can browse directly to restricted Drupal pages from an address that should be denied.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Drupal sites that use the Restrict route by IP module to limit access to certain routes by client address. Sites that do not install this module are not affected. The sources do not say whether a default configuration is vulnerable.
No product ranges from the sources yet.
drush pm:list --filter=restrict_route_by_ip or in the Drupal admin under Extend.2.0.1 or later than 1.3.1 on the 1.x line; the sources give no exact fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incorrect Authorization vulnerability in Drupal Restrict route by IP allows Forceful Browsing. This issue affects Restrict route by IP versions: from 0.0.0 to 1.3.1, from 2.0.0 to 2.0.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-107255")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.