{"id":"CVE-2026-107309","kind":"vulnerability","aliases":["CVE-2026-107309"],"related":[],"title":"Drupal Easy Breadcrumb: missing access check lets visitors browse restricted pages","description":"Missing Authorization vulnerability in Drupal Easy Breadcrumb allows Forceful Browsing. This issue affects Easy Breadcrumb versions: from 0.0.0 to 2.0.11.","summary":"The Drupal Easy Breadcrumb module does not enforce authorization, so users can reach pages they should not be able to see by forced browsing. The sources list affected versions from 0.0.0 up to 2.0.11 and give no further detail.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","easy-breadcrumb","package","self-hosted"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed version of the Easy Breadcrumb module with `drush pm:list --filter=easy_breadcrumb` or in the Drupal admin under Extend.","fix":"- Easy Breadcrumb versions from 0.0.0 to 2.0.11 are affected; the sources do not state a fixed version.","status":"open","published_at":"2026-10-30T04:17:58+00:00","first_seen_at":"2026-10-30T04:28:36+00:00","triaged_at":"2026-10-30T04:31:25+00:00","updated_at":"2026-10-30T04:31:25+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-30T04:31:25Z","model":"claude-haiku-5-5","output":{"fix":"- Easy Breadcrumb versions from 0.0.0 to 2.0.11 are affected; the sources do not state a fixed version.","reach":"internet","title":"Drupal Easy Breadcrumb: missing access check lets visitors browse restricted pages","impact":"low","summary":"The Drupal Easy Breadcrumb module does not enforce authorization, so users can reach pages they should not be able to see by forced browsing. The sources list affected versions from 0.0.0 up to 2.0.11 and give no further detail.","audience":"businesses","category":"package","nicknames":[],"who_cares":["drupal","easy-breadcrumb","self-hosted"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown access to restricted pages or content","analyst_note":"Check the NVD entry and the Drupal security advisory for the fixed version and the exact exposed pages.","how_to_check":"- Check the installed version of the Easy Breadcrumb module with `drush pm:list --filter=easy_breadcrumb` or in the Drupal admin under Extend.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Sites running the Drupal Easy Breadcrumb module in the affected version range. The sources do not say which configurations or pages are exposed, so the exact exposure is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000674,"input_tokens":4089,"output_tokens":531,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107309':14A,17A '-2026':13A,16A '0.0.0':56B,82C '2.0.11':59B,84C 'abl':44B 'access':5A 'affect':53B,77C 'allow':72C 'author':34B,66C 'breadcrumb':3A,21B,29B,71C,79C 'brows':9A,49B,74C 'check':6A 'cve':12A,15A 'detail':64B 'drupal':1A,18B,27B,69C 'easi':2A,20B,28B,70C,78C 'easy-breadcrumb':19B 'enforc':33B 'forc':48B,73C 'give':61B 'host':25B 'issu':76C 'let':7A 'list':52B 'miss':4A,65C 'modul':30B 'packag':22B 'page':11A,39B 'reach':38B 'restrict':10A 'see':46B 'self':24B 'self-host':23B 'sourc':51B 'user':36B 'version':54B,80C 'visitor':8A 'vulner':67C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Drupal Easy Breadcrumb module in the affected version range. The sources do not say which configurations or pages are exposed, so the exact exposure is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:17:58+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107309","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107309","severity":null,"published_at":"2026-10-30T04:17:58+00:00","modified_at":"2026-10-30T04:17:58+00:00","first_seen_at":"2026-10-30T04:28:36+00:00","fetched_at":"2026-10-30T04:28:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}