{"id":"CVE-2026-107263","kind":"vulnerability","aliases":["CVE-2026-107263"],"related":[],"title":"Drupal Gutenberg: incorrect authorization lets users force browsing to restricted pages","description":"Incorrect Authorization vulnerability in Drupal Gutenberg allows Forceful Browsing. This issue affects Gutenberg versions: from 0.0.0 to 2.15.0, from 3.0.0 to 3.0.7.","summary":"Drupal Gutenberg, a page-builder module for Drupal, has an incorrect authorization flaw that allows forceful browsing. An attacker can reach content or functions they should not be able to access by requesting URLs directly.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","gutenberg","package","php"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed Gutenberg module version in the Drupal project (for example with `drush pm:list --filter=gutenberg` or the module's `composer.lock` entry).\n- Compare against the affected ranges: `0.0.0` to `2.15.0` and `3.0.0` to `3.0.7`.","fix":null,"status":"open","published_at":"2026-10-30T04:17:55+00:00","first_seen_at":"2026-10-30T04:28:35+00:00","triaged_at":"2026-10-30T04:31:33+00:00","updated_at":"2026-10-30T04:31:33+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T04:31:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Drupal Gutenberg: incorrect authorization lets users force browsing to restricted pages","impact":"medium","summary":"Drupal Gutenberg, a page-builder module for Drupal, has an incorrect authorization flaw that allows forceful browsing. An attacker can reach content or functions they should not be able to access by requesting URLs directly.","audience":"developers","category":"package","nicknames":[],"who_cares":["drupal","gutenberg","php"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized users reach restricted pages or functions","analyst_note":"Find the Drupal security advisory for Gutenberg to confirm affected routes, required permissions and the fixed version; the NVD entry gives no fix.","how_to_check":"- Check the installed Gutenberg module version in the Drupal project (for example with `drush pm:list --filter=gutenberg` or the module's `composer.lock` entry).\n- Compare against the affected ranges: `0.0.0` to `2.15.0` and `3.0.0` to `3.0.7`.","plain_action":"","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Drupal sites running the Gutenberg module in the affected version ranges are exposed. The sources do not say which routes or permissions are involved, so the exact exposure is unknown. Sites not using the Gutenberg module can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000687,"input_tokens":4097,"output_tokens":554,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107263':14A,17A '-2026':13A,16A '0.0.0':73C '2.15.0':75C '3.0.0':77C '3.0.7':79C 'abl':51B 'access':53B 'affect':69C 'allow':37B,64C 'attack':41B 'author':4A,34B,59C 'brows':8A,39B,66C 'builder':27B 'content':44B 'cve':12A,15A 'direct':57B 'drupal':1A,18B,22B,30B,62C 'flaw':35B 'forc':7A,38B,65C 'function':46B 'gutenberg':2A,19B,23B,63C,70C 'incorrect':3A,33B,58C 'issu':68C 'let':5A 'modul':28B 'packag':20B 'page':11A,26B 'page-build':25B 'php':21B 'reach':43B 'request':55B 'restrict':10A 'url':56B 'user':6A 'version':71C 'vulner':60C","nicknames":[],"mitigations":[],"who_affected":"Drupal sites running the Gutenberg module in the affected version ranges are exposed. The sources do not say which routes or permissions are involved, so the exact exposure is unknown. Sites not using the Gutenberg module can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T04:17:55+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107263","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107263","severity":null,"published_at":"2026-10-30T04:17:55+00:00","modified_at":"2026-10-30T04:17:55+00:00","first_seen_at":"2026-10-30T04:28:35+00:00","fetched_at":"2026-10-30T04:28:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}