{"id":"CVE-2026-107267","kind":"vulnerability","aliases":["CVE-2026-107267"],"related":[],"title":"Drupal DKAN: missing authorization lets users browse restricted pages","description":"Missing Authorization vulnerability in Drupal DKAN allows Forceful Browsing. This issue affects DKAN versions: from 0.0.0 to 4.0.4, from 4.1.0 to 4.1.5.","summary":"Drupal DKAN, an open data publishing module, fails to check authorization on some routes, so a visitor can reach content they should not see by forced browsing. The sources do not say what data is exposed.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dkan","drupal","open-data","package"],"not_affected_if":["dkan-not-installed"],"how_to_check":"- Check the installed DKAN version with `drush pm:list --filter=dkan` or in the composer.lock file.\n- Confirm whether the site is running DKAN `4.0.4` or earlier, or `4.1.0` through `4.1.5`.","fix":"- DKAN versions `4.0.4` and earlier, and `4.1.0` through `4.1.5`, are affected; the sources do not name a fixed version.","status":"open","published_at":"2026-10-30T04:17:58+00:00","first_seen_at":"2026-10-30T04:28:36+00:00","triaged_at":"2026-10-30T04:31:29+00:00","updated_at":"2026-10-30T04:31:29+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T04:31:29Z","model":"claude-haiku-5-5","output":{"fix":"- DKAN versions `4.0.4` and earlier, and `4.1.0` through `4.1.5`, are affected; the sources do not name a fixed version.","reach":"internet","title":"Drupal DKAN: missing authorization lets users browse restricted pages","impact":"medium","summary":"Drupal DKAN, an open data publishing module, fails to check authorization on some routes, so a visitor can reach content they should not see by forced browsing. The sources do not say what data is exposed.","audience":"businesses","category":"package","nicknames":[],"who_cares":["drupal","dkan","open-data"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown access to restricted DKAN content","analyst_note":"Find the DKAN security advisory and fixed version, and which routes or data are unauthorized.","how_to_check":"- Check the installed DKAN version with `drush pm:list --filter=dkan` or in the composer.lock file.\n- Confirm whether the site is running DKAN `4.0.4` or earlier, or `4.1.0` through `4.1.5`.","plain_action":"","needs_analyst":true,"not_affected_if":["dkan-not-installed"],"who_is_affected":"Sites running Drupal with the DKAN open data module in the affected version ranges are exposed. The sources do not describe the specific routes or the data involved, so the exact scope is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000674,"input_tokens":4087,"output_tokens":530,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107267':12A,15A '-2026':11A,14A '0.0.0':73C '4.0.4':75C '4.1.0':77C '4.1.5':79C 'affect':69C 'allow':64C 'author':4A,32B,59C 'brows':7A,48B,66C 'check':31B 'content':41B 'cve':10A,13A 'data':20B,26B,55B 'dkan':2A,16B,23B,63C,70C 'drupal':1A,17B,22B,62C 'expos':57B 'fail':29B 'forc':47B,65C 'issu':68C 'let':5A 'miss':3A,58C 'modul':28B 'open':19B,25B 'open-data':18B 'packag':21B 'page':9A 'publish':27B 'reach':40B 'restrict':8A 'rout':35B 'say':53B 'see':45B 'sourc':50B 'user':6A 'version':71C 'visitor':38B 'vulner':60C","nicknames":[],"mitigations":[],"who_affected":"Sites running Drupal with the DKAN open data module in the affected version ranges are exposed. The sources do not describe the specific routes or the data involved, so the exact scope is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:17:58+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107267","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107267","severity":null,"published_at":"2026-10-30T04:17:58+00:00","modified_at":"2026-10-30T04:17:58+00:00","first_seen_at":"2026-10-30T04:28:36+00:00","fetched_at":"2026-10-30T04:28:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}