{"id":"CVE-2026-107257","kind":"vulnerability","aliases":["CVE-2026-107257"],"related":[],"title":"Drupal Actstream: incorrect authorization lets users browse restricted pages","description":"Incorrect Authorization vulnerability in Drupal Actstream allows Forceful Browsing. This issue affects Actstream versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1.","summary":"Drupal Actstream, a module that records and displays activity streams, has an incorrect authorization flaw that allows forceful browsing to content users should not reach. An attacker can request restricted URLs directly and view data the site did not intend to expose.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["actstream","drupal","package","php"],"not_affected_if":["actstream-not-installed"],"how_to_check":"- Check the installed Actstream version in the Drupal project's `composer.lock` or with `drush pm:list --filter=actstream`\n- Look for Actstream versions in the range listed as affected: `0.0.0` to `2.0.1` and `2.1.0` to `2.1.1`","fix":"- Actstream versions from `0.0.0` to `2.0.1` and from `2.1.0` to `2.1.1` are affected; the fixed version is unknown from the sources","status":"open","published_at":"2026-10-30T04:17:53+00:00","first_seen_at":"2026-10-30T04:28:35+00:00","triaged_at":"2026-10-30T04:31:41+00:00","updated_at":"2026-10-30T04:31:41+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-30T04:31:41Z","model":"claude-haiku-5-5","output":{"fix":"- Actstream versions from `0.0.0` to `2.0.1` and from `2.1.0` to `2.1.1` are affected; the fixed version is unknown from the sources","reach":"internet","title":"Drupal Actstream: incorrect authorization lets users browse restricted pages","impact":"medium","summary":"Drupal Actstream, a module that records and displays activity streams, has an incorrect authorization flaw that allows forceful browsing to content users should not reach. An attacker can request restricted URLs directly and view data the site did not intend to expose.","audience":"businesses","category":"package","nicknames":[],"who_cares":["drupal","actstream","php"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized users read restricted activity stream pages","analyst_note":"Find the NVD entry's CNA details and the Drupal security advisory for the fixed Actstream version and the required authorization conditions.","how_to_check":"- Check the installed Actstream version in the Drupal project's `composer.lock` or with `drush pm:list --filter=actstream`\n- Look for Actstream versions in the range listed as affected: `0.0.0` to `2.0.1` and `2.1.0` to `2.1.1`","plain_action":"","needs_analyst":true,"not_affected_if":["actstream-not-installed"],"who_is_affected":"Sites running the Drupal Actstream module within the affected version ranges are exposed, particularly where activity stream pages are reachable by users who should not see them. Sites that do not use Actstream can skip it. The sources do not describe the exact configuration required.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000709,"input_tokens":4091,"output_tokens":599,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107257':12A,15A '-2026':11A,14A '0.0.0':77C '2.0.1':79C '2.1.0':81C '2.1.1':83C 'activ':28B 'actstream':2A,16B,21B,67C,74C 'affect':73C 'allow':36B,68C 'attack':46B 'author':4A,33B,63C 'brows':7A,38B,70C 'content':40B 'cve':10A,13A 'data':54B 'direct':51B 'display':27B 'drupal':1A,17B,20B,66C 'expos':61B 'flaw':34B 'forc':37B,69C 'incorrect':3A,32B,62C 'intend':59B 'issu':72C 'let':5A 'modul':23B 'packag':18B 'page':9A 'php':19B 'reach':44B 'record':25B 'request':48B 'restrict':8A,49B 'site':56B 'stream':29B 'url':50B 'user':6A,41B 'version':75C 'view':53B 'vulner':64C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Drupal Actstream module within the affected version ranges are exposed, particularly where activity stream pages are reachable by users who should not see them. Sites that do not use Actstream can skip it. The sources do not describe the exact configuration required.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:17:53+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107257","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107257","severity":null,"published_at":"2026-10-30T04:17:53+00:00","modified_at":"2026-10-30T04:17:53+00:00","first_seen_at":"2026-10-30T04:28:35+00:00","fetched_at":"2026-10-30T04:28:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}