{"id":"CVE-2026-114533","kind":"vulnerability","aliases":["CVE-2026-114533"],"related":[],"title":"Drupal Ágora Transparency Theme: missing access check exposes pages to forced browsing","description":"Missing Authorization vulnerability in Drupal Ágora Transparency Theme allows Forceful Browsing. This issue affects Ágora Transparency Theme versions: from 0.0.0 to 1.2.3.","summary":"The Drupal Ágora Transparency Theme does not enforce authorization on some content, so a visitor who guesses or requests the direct URL can reach it. The sources do not state what content is exposed.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["agora-transparency-theme","drupal","other","self-hosted"],"not_affected_if":["theme-not-installed"],"how_to_check":"- Look for the Ágora Transparency Theme in the site's Drupal theme list (`drush pm:list --type=theme` or the Appearance admin page)\n- Check the installed theme version against the affected range, 0.0.0 to 1.2.3","fix":"- Ágora Transparency Theme: unknown, the sources give no fixed version","status":"open","published_at":"2026-10-30T04:18:12+00:00","first_seen_at":"2026-10-30T04:28:37+00:00","triaged_at":"2026-10-30T04:31:05+00:00","updated_at":"2026-10-30T04:31:05+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-10-30T04:31:05Z","model":"claude-haiku-5-5","output":{"fix":"- Ágora Transparency Theme: unknown, the sources give no fixed version","reach":"internet","title":"Drupal Ágora Transparency Theme: missing access check exposes pages to forced browsing","impact":"medium","summary":"The Drupal Ágora Transparency Theme does not enforce authorization on some content, so a visitor who guesses or requests the direct URL can reach it. The sources do not state what content is exposed.","audience":"businesses","category":"other","nicknames":[],"who_cares":["drupal","agora-transparency-theme","self-hosted"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized visitors read restricted pages directly by URL","analyst_note":"Confirm the fixed version and which pages lack the access check from https://nvd.nist.gov/vuln/detail/CVE-2026-114533 or the Drupal security advisory.","how_to_check":"- Look for the Ágora Transparency Theme in the site's Drupal theme list (`drush pm:list --type=theme` or the Appearance admin page)\n- Check the installed theme version against the affected range, 0.0.0 to 1.2.3\n- unknown whether a specific configuration or setting changes exposure","plain_action":"","needs_analyst":true,"not_affected_if":["theme-not-installed"],"who_is_affected":"Sites running the Drupal Ágora Transparency Theme in the affected version range, 0.0.0 to 1.2.3, are in scope. The sources do not say which pages or data are reachable or whether any login is needed. Sites that do not use this theme are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000711,"input_tokens":4092,"output_tokens":603,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-114533':15A,18A '-2026':14A,17A '0.0.0':81C '1.2.3':83C 'access':6A 'affect':75C 'agora':20B 'agora-transparency-them':19B 'allow':70C 'author':36B,63C 'brows':12A,72C 'check':7A 'content':39B,59B 'cve':13A,16A 'direct':48B 'drupal':1A,23B,29B,66C 'enforc':35B 'expos':8A,61B 'forc':11A,71C 'guess':44B 'host':27B 'issu':74C 'miss':5A,62C 'page':9A 'reach':51B 'request':46B 'self':26B 'self-host':25B 'sourc':54B 'state':57B 'theme':4A,22B,32B,69C,78C 'transpar':3A,21B,31B,68C,77C 'url':49B 'version':79C 'visitor':42B 'vulner':64C 'ágora':2A,30B,67C,76C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Drupal Ágora Transparency Theme in the affected version range, 0.0.0 to 1.2.3, are in scope. The sources do not say which pages or data are reachable or whether any login is needed. Sites that do not use this theme are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:18:12+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114533","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114533","severity":null,"published_at":"2026-10-30T04:18:12+00:00","modified_at":"2026-10-30T04:18:12+00:00","first_seen_at":"2026-10-30T04:28:37+00:00","fetched_at":"2026-10-30T04:28:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}