{"id":"CVE-2026-107256","kind":"vulnerability","aliases":["CVE-2026-107256"],"related":[],"title":"Drupal Shield: missing limit on login attempts allows brute-force guessing","description":"Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Shield allows Brute Force. This issue affects Shield versions: from 0.0.0 to 1.9.0.","summary":"The Drupal Shield module does not restrict excessive authentication attempts, so an attacker can repeatedly guess passwords. Successful guessing would give access to the affected Drupal site's accounts.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","self-hosted","shield"],"not_affected_if":["shield-not-installed"],"how_to_check":"- Check the installed Shield version (for example with `drush pm:list --filter=shield` or in the Drupal admin Extend page) and see whether it is `1.9.0` or earlier.","fix":"- Shield versions up to and including `1.9.0` are affected; the sources do not state a fixed version.","status":"open","published_at":"2026-10-30T04:17:52+00:00","first_seen_at":"2026-10-30T04:28:35+00:00","triaged_at":"2026-10-30T04:31:41+00:00","updated_at":"2026-10-30T04:31:41+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T04:31:41Z","model":"claude-haiku-5-5","output":{"fix":"- Shield versions up to and including `1.9.0` are affected; the sources do not state a fixed version.","reach":"internet","title":"Drupal Shield: missing limit on login attempts allows brute-force guessing","impact":"high","summary":"The Drupal Shield module does not restrict excessive authentication attempts, so an attacker can repeatedly guess passwords. Successful guessing would give access to the affected Drupal site's accounts.","audience":"businesses","category":"package","nicknames":[],"who_cares":["drupal","shield","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker guesses user passwords and logs into accounts","analyst_note":"Confirm the fixed Shield version and whether the flaw depends on any configuration, using the Drupal security advisory for Shield (not in the sources given).","how_to_check":"- Check the installed Shield version (for example with `drush pm:list --filter=shield` or in the Drupal admin Extend page) and see whether it is `1.9.0` or earlier.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["shield-not-installed"],"who_is_affected":"Drupal sites that have the Shield module installed at version 1.9.0 or earlier are affected, since Shield is the component that handles the authentication protection. Sites without Shield, or with a newer version, are not in the stated range. The sources do not say whether a non-default configuration is required.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000683,"input_tokens":4088,"output_tokens":549,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107256':15A,18A '-2026':14A,17A '0.0.0':73C '1.9.0':75C 'access':46B 'account':53B 'affect':49B,69C 'allow':8A,64C 'attack':37B 'attempt':7A,34B,59C 'authent':33B,58C 'brute':10A,65C 'brute-forc':9A 'cve':13A,16A 'drupal':1A,19B,26B,50B,62C 'excess':32B,57C 'forc':11A,66C 'give':45B 'guess':12A,40B,43B 'host':23B 'improp':54C 'issu':68C 'limit':4A 'login':6A 'miss':3A 'modul':28B 'packag':20B 'password':41B 'repeat':39B 'restrict':31B,55C 'self':22B 'self-host':21B 'shield':2A,24B,27B,63C,70C 'site':51B 'success':42B 'version':71C 'vulner':60C 'would':44B","nicknames":[],"mitigations":[],"who_affected":"Drupal sites that have the Shield module installed at version 1.9.0 or earlier are affected, since Shield is the component that handles the authentication protection. Sites without Shield, or with a newer version, are not in the stated range. The sources do not say whether a non-default configuration is required.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:17:52+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107256","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107256","severity":null,"published_at":"2026-10-30T04:17:52+00:00","modified_at":"2026-10-30T04:17:52+00:00","first_seen_at":"2026-10-30T04:28:35+00:00","fetched_at":"2026-10-30T04:28:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}