Live › vulnerability › CVE-2026-114535
The Drupal Swiper formatter module is missing an authorization check, so a visitor can reach content they should not see by requesting it directly. The sources do not describe the exact data exposed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Sites running Drupal with the Swiper formatter module in the affected version ranges. The sources do not say which content types or configurations expose data, so the exact exposure is unknown.
No product ranges from the sources yet.
drush pm:list --filter=swiper.0.0.0 to 2.1.2 and 3.0.1 to 3.1.0.3.1.0 on the 3.x line and after 2.1.2 on the 2.x line are outside the affected ranges, per the description; the exact fixed version is unknown.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in Drupal Swiper formatter allows Forceful Browsing. This issue affects Swiper formatter versions: from 0.0.0 to 2.1.2, from 3.0.1 to 3.1.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-114535")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.