{"id":"CVE-2026-114530","kind":"vulnerability","aliases":["CVE-2026-114530"],"related":[],"title":"Drupal Dopup: incorrect authorization lets visitors browse restricted pages","description":"Incorrect Authorization vulnerability in Drupal Dopup allows Forceful Browsing. This issue affects Dopup versions: from 0.0.0 to 1.0.7.","summary":"The Drupal Dopup module has an incorrect authorization flaw that allows forceful browsing, meaning users can reach content or endpoints they should not access by requesting them directly. The sources state the affected range as versions 0.0.0 through 1.0.7 but give no impact details beyond that.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dopup","drupal","package"],"not_affected_if":[],"how_to_check":"- Check the installed Dopup module version in the Drupal project (for example with `drush pm:list` or the module's info file) and see whether it falls within 0.0.0 to 1.0.7.","fix":null,"status":"open","published_at":"2026-10-30T04:18:11+00:00","first_seen_at":"2026-10-30T04:28:37+00:00","triaged_at":"2026-10-30T04:31:08+00:00","updated_at":"2026-10-30T04:31:08+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-30T04:31:08Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Drupal Dopup: incorrect authorization lets visitors browse restricted pages","impact":"medium","summary":"The Drupal Dopup module has an incorrect authorization flaw that allows forceful browsing, meaning users can reach content or endpoints they should not access by requesting them directly. The sources state the affected range as versions 0.0.0 through 1.0.7 but give no impact details beyond that.","audience":"businesses","category":"package","nicknames":[],"who_cares":["drupal","dopup"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown","analyst_note":"Find the NVD record details or the Drupal security advisory for CVE-2026-114530 to confirm the exposed resources, required privileges and the fixed version.","how_to_check":"- Check the installed Dopup module version in the Drupal project (for example with `drush pm:list` or the module's info file) and see whether it falls within 0.0.0 to 1.0.7.\n- unknown for other checks; the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Sites running the Drupal Dopup module at versions 0.0.0 through 1.0.7 are in the stated affected range. The sources do not describe which pages or roles are exposed, so unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000666,"input_tokens":4075,"output_tokens":518,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-114530':12A,15A '-2026':11A,14A '0.0.0':55B,79C '1.0.7':57B,81C 'access':42B 'affect':51B,75C 'allow':29B,70C 'author':4A,26B,65C 'beyond':63B 'brows':7A,31B,72C 'content':36B 'cve':10A,13A 'detail':62B 'direct':46B 'dopup':2A,16B,21B,69C,76C 'drupal':1A,17B,20B,68C 'endpoint':38B 'flaw':27B 'forc':30B,71C 'give':59B 'impact':61B 'incorrect':3A,25B,64C 'issu':74C 'let':5A 'mean':32B 'modul':22B 'packag':18B 'page':9A 'rang':52B 'reach':35B 'request':44B 'restrict':8A 'sourc':48B 'state':49B 'user':33B 'version':54B,77C 'visitor':6A 'vulner':66C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Drupal Dopup module at versions 0.0.0 through 1.0.7 are in the stated affected range. The sources do not describe which pages or roles are exposed, so unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:18:11+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114530","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114530","severity":null,"published_at":"2026-10-30T04:18:11+00:00","modified_at":"2026-10-30T04:18:11+00:00","first_seen_at":"2026-10-30T04:28:37+00:00","fetched_at":"2026-10-30T04:28:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}