{"id":"CVE-2026-107266","kind":"vulnerability","aliases":["CVE-2026-107266"],"related":[],"title":"Drupal Views Share: missing authorization lets users browse restricted pages","description":"Missing Authorization vulnerability in Drupal Views Share allows Forceful Browsing. This issue affects Views Share versions: from 0.0.0 to 2.0.1.","summary":"Drupal Views Share lacks an authorization check, so a user can reach pages by direct URL that they should not see. The sources do not say what data those pages expose.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","views-share"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed `views_share` module version in the Drupal project (for example `composer show drupal/views_share`).\n- Look for Views Share shared-view pages and confirm which roles can open them.","fix":null,"status":"open","published_at":"2026-10-30T04:17:57+00:00","first_seen_at":"2026-10-30T04:28:36+00:00","triaged_at":"2026-10-30T04:31:30+00:00","updated_at":"2026-10-30T04:31:30+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-30T04:31:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Drupal Views Share: missing authorization lets users browse restricted pages","impact":"low","summary":"Drupal Views Share lacks an authorization check, so a user can reach pages by direct URL that they should not see. The sources do not say what data those pages expose.","audience":"developers","category":"package","nicknames":[],"who_cares":["drupal","views-share"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown; restricted views reachable by direct URL","analyst_note":"Check the Drupal security advisory for Views Share to confirm the fixed version and which data is exposed.","how_to_check":"- Check the installed `views_share` module version in the Drupal project (for example `composer show drupal/views_share`).\n- Look for Views Share shared-view pages and confirm which roles can open them.","plain_action":"","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Drupal sites that run the Views Share module, versions from 0.0.0 to 2.0.1 per the NVD entry, are affected. Sites without this module can skip it. The sources do not say which access checks are missing or which data is exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000639,"input_tokens":4071,"output_tokens":463,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107266':13A,16A '-2026':12A,15A '0.0.0':70C '2.0.1':72C 'affect':65C 'allow':60C 'author':5A,27B,54C 'brows':8A,62C 'check':28B 'cve':11A,14A 'data':49B 'direct':36B 'drupal':1A,17B,22B,57C 'expos':52B 'forc':61C 'issu':64C 'lack':25B 'let':6A 'miss':4A,53C 'packag':18B 'page':10A,34B,51B 'reach':33B 'restrict':9A 'say':47B 'see':42B 'share':3A,21B,24B,59C,67C 'sourc':44B 'url':37B 'user':7A,31B 'version':68C 'view':2A,20B,23B,58C,66C 'views-shar':19B 'vulner':55C","nicknames":[],"mitigations":[],"who_affected":"Drupal sites that run the Views Share module, versions from 0.0.0 to 2.0.1 per the NVD entry, are affected. Sites without this module can skip it. The sources do not say which access checks are missing or which data is exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T04:17:57+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107266","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107266","severity":null,"published_at":"2026-10-30T04:17:57+00:00","modified_at":"2026-10-30T04:17:57+00:00","first_seen_at":"2026-10-30T04:28:36+00:00","fetched_at":"2026-10-30T04:28:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}