---
id: "CVE-2026-107257"
kind: "vulnerability"
aliases: ["CVE-2026-107257"]
title: "Drupal Actstream: incorrect authorization lets users browse restricted pages"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["actstream", "drupal", "package", "php"]
not_affected_if: ["actstream-not-installed"]
published_at: "2026-10-30T04:17:53+00:00"
first_seen_at: "2026-10-30T04:28:35+00:00"
updated_at: "2026-10-30T04:31:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107257", "first_seen_at": "2026-10-30T04:28:35+00:00"}]
---

# Drupal Actstream: incorrect authorization lets users browse restricted pages

Drupal Actstream, a module that records and displays activity streams, has an incorrect authorization flaw that allows forceful browsing to content users should not reach. An attacker can request restricted URLs directly and view data the site did not intend to expose.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Actstream version in the Drupal project's `composer.lock` or with `drush pm:list --filter=actstream`
- Look for Actstream versions in the range listed as affected: `0.0.0` to `2.0.1` and `2.1.0` to `2.1.1`

## Fix

- Actstream versions from `0.0.0` to `2.0.1` and from `2.1.0` to `2.1.1` are affected; the fixed version is unknown from the sources

## Timeline

- 2026-10-30T04:28:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107257

## From the sources

Incorrect Authorization vulnerability in Drupal Actstream allows Forceful Browsing. This issue affects Actstream versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_