---
id: "CVE-2026-114530"
kind: "vulnerability"
aliases: ["CVE-2026-114530"]
title: "Drupal Dopup: incorrect authorization lets visitors browse restricted pages"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["dopup", "drupal", "package"]
not_affected_if: []
published_at: "2026-10-30T04:18:11+00:00"
first_seen_at: "2026-10-30T04:28:37+00:00"
updated_at: "2026-10-30T04:31:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114530", "first_seen_at": "2026-10-30T04:28:37+00:00"}]
---

# Drupal Dopup: incorrect authorization lets visitors browse restricted pages

The Drupal Dopup module has an incorrect authorization flaw that allows forceful browsing, meaning users can reach content or endpoints they should not access by requesting them directly. The sources state the affected range as versions 0.0.0 through 1.0.7 but give no impact details beyond that.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Dopup module version in the Drupal project (for example with `drush pm:list` or the module's info file) and see whether it falls within 0.0.0 to 1.0.7.

## Timeline

- 2026-10-30T04:28:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114530

## From the sources

Incorrect Authorization vulnerability in Drupal Dopup allows Forceful Browsing. This issue affects Dopup versions: from 0.0.0 to 1.0.7.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_