---
id: "CVE-2026-107263"
kind: "vulnerability"
aliases: ["CVE-2026-107263"]
title: "Drupal Gutenberg: incorrect authorization lets users force browsing to restricted pages"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["drupal", "gutenberg", "package", "php"]
not_affected_if: ["module-not-installed"]
published_at: "2026-10-30T04:17:55+00:00"
first_seen_at: "2026-10-30T04:28:35+00:00"
updated_at: "2026-10-30T04:31:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107263", "first_seen_at": "2026-10-30T04:28:35+00:00"}]
---

# Drupal Gutenberg: incorrect authorization lets users force browsing to restricted pages

Drupal Gutenberg, a page-builder module for Drupal, has an incorrect authorization flaw that allows forceful browsing. An attacker can reach content or functions they should not be able to access by requesting URLs directly.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Gutenberg module version in the Drupal project (for example with `drush pm:list --filter=gutenberg` or the module's `composer.lock` entry).
- Compare against the affected ranges: `0.0.0` to `2.15.0` and `3.0.0` to `3.0.7`.

## Timeline

- 2026-10-30T04:28:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107263

## From the sources

Incorrect Authorization vulnerability in Drupal Gutenberg allows Forceful Browsing. This issue affects Gutenberg versions: from 0.0.0 to 2.15.0, from 3.0.0 to 3.0.7.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_