Live › vulnerability › CVE-2026-107309
The Drupal Easy Breadcrumb module does not enforce authorization, so users can reach pages they should not be able to see by forced browsing. The sources list affected versions from 0.0.0 up to 2.0.11 and give no further detail.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Sites running the Drupal Easy Breadcrumb module in the affected version range. The sources do not say which configurations or pages are exposed, so the exact exposure is unknown.
No product ranges from the sources yet.
drush pm:list --filter=easy_breadcrumb or in the Drupal admin under Extend.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in Drupal Easy Breadcrumb allows Forceful Browsing. This issue affects Easy Breadcrumb versions: from 0.0.0 to 2.0.11.
This page as .md · .json · in your agent: get_signal("CVE-2026-107309")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.