Live › vulnerability › CVE-2026-107263
Drupal Gutenberg, a page-builder module for Drupal, has an incorrect authorization flaw that allows forceful browsing. An attacker can reach content or functions they should not be able to access by requesting URLs directly.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Drupal sites running the Gutenberg module in the affected version ranges are exposed. The sources do not say which routes or permissions are involved, so the exact exposure is unknown. Sites not using the Gutenberg module can skip it.
No product ranges from the sources yet.
drush pm:list --filter=gutenberg or the module's composer.lock entry).0.0.0 to 2.15.0 and 3.0.0 to 3.0.7.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incorrect Authorization vulnerability in Drupal Gutenberg allows Forceful Browsing. This issue affects Gutenberg versions: from 0.0.0 to 2.15.0, from 3.0.0 to 3.0.7.
This page as .md · .json · in your agent: get_signal("CVE-2026-107263")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.