{"id":"CVE-2026-107255","kind":"vulnerability","aliases":["CVE-2026-107255"],"related":[],"title":"Drupal Restrict route by IP module lets forceful browsing bypass access rules","description":"Incorrect Authorization vulnerability in Drupal Restrict route by IP allows Forceful Browsing. This issue affects Restrict route by IP versions: from 0.0.0 to 1.3.1, from 2.0.0 to 2.0.1.","summary":"The Drupal Restrict route by IP module has an incorrect authorization flaw that lets a visitor reach routes the IP restriction should block. An attacker can browse directly to restricted Drupal pages from an address that should be denied.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","php"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed version of the Restrict route by IP module with `drush pm:list --filter=restrict_route_by_ip` or in the Drupal admin under Extend.\n- Confirm whether the site relies on this module to restrict routes by IP address.","fix":"- Move Restrict route by IP to a version later than `2.0.1` or later than `1.3.1` on the 1.x line; the sources give no exact fixed version.","status":"open","published_at":"2026-10-30T04:17:51+00:00","first_seen_at":"2026-10-30T04:28:35+00:00","triaged_at":"2026-10-30T04:31:41+00:00","updated_at":"2026-10-30T04:31:41+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T04:31:41Z","model":"claude-haiku-5-5","output":{"fix":"- Move Restrict route by IP to a version later than `2.0.1` or later than `1.3.1` on the 1.x line; the sources give no exact fixed version.","reach":"internet","title":"Drupal Restrict route by IP module lets forceful browsing bypass access rules","impact":"medium","summary":"The Drupal Restrict route by IP module has an incorrect authorization flaw that lets a visitor reach routes the IP restriction should block. An attacker can browse directly to restricted Drupal pages from an address that should be denied.","audience":"developers","category":"package","nicknames":[],"who_cares":["drupal","php"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"restricted Drupal routes are reachable from blocked IP addresses","analyst_note":"Find the advisory or Drupal security announcement for the fixed version and whether a default configuration is affected.","how_to_check":"- Check the installed version of the Restrict route by IP module with `drush pm:list --filter=restrict_route_by_ip` or in the Drupal admin under Extend.\n- Confirm whether the site relies on this module to restrict routes by IP address.","plain_action":"","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Drupal sites that use the Restrict route by IP module to limit access to certain routes by client address. Sites that do not install this module are not affected. The sources do not say whether a default configuration is vulnerable.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000687,"input_tokens":4103,"output_tokens":554,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107255':15A,18A '-2026':14A,17A '0.0.0':82C '1.3.1':84C '2.0.0':86C '2.0.1':88C 'access':11A 'address':56B 'affect':75C 'allow':70C 'attack':46B 'author':32B,62C 'block':44B 'brows':9A,48B,72C 'bypass':10A 'cve':13A,16A 'deni':60B 'direct':49B 'drupal':1A,19B,23B,52B,65C 'flaw':33B 'forc':8A,71C 'incorrect':31B,61C 'ip':5A,27B,41B,69C,79C 'issu':74C 'let':7A,35B 'modul':6A,28B 'packag':20B 'page':53B 'php':21B 'reach':38B 'restrict':2A,24B,42B,51B,66C,76C 'rout':3A,25B,39B,67C,77C 'rule':12A 'version':80C 'visitor':37B 'vulner':63C","nicknames":[],"mitigations":[],"who_affected":"Drupal sites that use the Restrict route by IP module to limit access to certain routes by client address. Sites that do not install this module are not affected. The sources do not say whether a default configuration is vulnerable.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T04:17:51+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107255","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107255","severity":null,"published_at":"2026-10-30T04:17:51+00:00","modified_at":"2026-10-30T04:17:51+00:00","first_seen_at":"2026-10-30T04:28:35+00:00","fetched_at":"2026-10-30T04:28:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}