Live › vulnerability › CVE-2026-107267
Drupal DKAN, an open data publishing module, fails to check authorization on some routes, so a visitor can reach content they should not see by forced browsing. The sources do not say what data is exposed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Sites running Drupal with the DKAN open data module in the affected version ranges are exposed. The sources do not describe the specific routes or the data involved, so the exact scope is unknown.
No product ranges from the sources yet.
drush pm:list --filter=dkan or in the composer.lock file.4.0.4 or earlier, or 4.1.0 through 4.1.5.4.0.4 and earlier, and 4.1.0 through 4.1.5, are affected; the sources do not name a fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in Drupal DKAN allows Forceful Browsing. This issue affects DKAN versions: from 0.0.0 to 4.0.4, from 4.1.0 to 4.1.5.
This page as .md · .json · in your agent: get_signal("CVE-2026-107267")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.