---
id: "CVE-2026-107309"
kind: "vulnerability"
aliases: ["CVE-2026-107309"]
title: "Drupal Easy Breadcrumb: missing access check lets visitors browse restricted pages"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["drupal", "easy-breadcrumb", "package", "self-hosted"]
not_affected_if: ["module-not-installed"]
published_at: "2026-10-30T04:17:58+00:00"
first_seen_at: "2026-10-30T04:28:36+00:00"
updated_at: "2026-10-30T04:31:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107309", "first_seen_at": "2026-10-30T04:28:36+00:00"}]
---

# Drupal Easy Breadcrumb: missing access check lets visitors browse restricted pages

The Drupal Easy Breadcrumb module does not enforce authorization, so users can reach pages they should not be able to see by forced browsing. The sources list affected versions from 0.0.0 up to 2.0.11 and give no further detail.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Easy Breadcrumb module with `drush pm:list --filter=easy_breadcrumb` or in the Drupal admin under Extend.

## Fix

- Easy Breadcrumb versions from 0.0.0 to 2.0.11 are affected; the sources do not state a fixed version.

## Timeline

- 2026-10-30T04:28:36+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107309

## From the sources

Missing Authorization vulnerability in Drupal Easy Breadcrumb allows Forceful Browsing. This issue affects Easy Breadcrumb versions: from 0.0.0 to 2.0.11.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_