{"id":"CVE-2026-114535","kind":"vulnerability","aliases":["CVE-2026-114535"],"related":[],"title":"Drupal Swiper formatter: missing access check lets visitors browse restricted content","description":"Missing Authorization vulnerability in Drupal Swiper formatter allows Forceful Browsing. This issue affects Swiper formatter versions: from 0.0.0 to 2.1.2, from 3.0.1 to 3.1.0.","summary":"The Drupal Swiper formatter module is missing an authorization check, so a visitor can reach content they should not see by requesting it directly. The sources do not describe the exact data exposed.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","php","swiper-formatter"],"not_affected_if":["unaffected-version"],"how_to_check":"- Check whether the Swiper formatter module is installed on the site, for example with `drush pm:list --filter=swiper`.\n- Confirm the installed version against the affected ranges: `0.0.0` to `2.1.2` and `3.0.1` to `3.1.0`.","fix":"- Versions after `3.1.0` on the 3.x line and after `2.1.2` on the 2.x line are outside the affected ranges, per the description; the exact fixed version is unknown.","status":"open","published_at":"2026-10-30T04:18:12+00:00","first_seen_at":"2026-10-30T04:28:37+00:00","triaged_at":"2026-10-30T04:30:00+00:00","updated_at":"2026-10-30T04:30:00+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T04:30:00Z","model":"claude-haiku-5-5","output":{"fix":"- Versions after `3.1.0` on the 3.x line and after `2.1.2` on the 2.x line are outside the affected ranges, per the description; the exact fixed version is unknown.","reach":"internet","title":"Drupal Swiper formatter: missing access check lets visitors browse restricted content","impact":"medium","summary":"The Drupal Swiper formatter module is missing an authorization check, so a visitor can reach content they should not see by requesting it directly. The sources do not describe the exact data exposed.","audience":"developers","category":"package","nicknames":[],"who_cares":["drupal","php","swiper-formatter"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Restricted content is readable by unauthenticated visitors via direct requests","analyst_note":"Confirm the fixed version and the exact content exposed from the Drupal security advisory for the Swiper formatter module.","how_to_check":"- Check whether the Swiper formatter module is installed on the site, for example with `drush pm:list --filter=swiper`.\n- Confirm the installed version against the affected ranges: `0.0.0` to `2.1.2` and `3.0.1` to `3.1.0`.","plain_action":"","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Sites running Drupal with the Swiper formatter module in the affected version ranges. The sources do not say which content types or configurations expose data, so the exact exposure is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00069,"input_tokens":4096,"output_tokens":560,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-114535':14A,17A '-2026':13A,16A '0.0.0':74C '2.1.2':76C '3.0.1':78C '3.1.0':80C 'access':5A 'affect':69C 'allow':64C 'author':32B,58C 'brows':9A,66C 'check':6A,33B 'content':11A,39B 'cve':12A,15A 'data':55B 'describ':52B 'direct':47B 'drupal':1A,18B,25B,61C 'exact':54B 'expos':56B 'forc':65C 'formatt':3A,23B,27B,63C,71C 'issu':68C 'let':7A 'miss':4A,30B,57C 'modul':28B 'packag':19B 'php':20B 'reach':38B 'request':45B 'restrict':10A 'see':43B 'sourc':49B 'swiper':2A,22B,26B,62C,70C 'swiper-formatt':21B 'version':72C 'visitor':8A,36B 'vulner':59C","nicknames":[],"mitigations":[],"who_affected":"Sites running Drupal with the Swiper formatter module in the affected version ranges. The sources do not say which content types or configurations expose data, so the exact exposure is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T04:18:12+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114535","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114535","severity":null,"published_at":"2026-10-30T04:18:12+00:00","modified_at":"2026-10-30T04:18:12+00:00","first_seen_at":"2026-10-30T04:28:37+00:00","fetched_at":"2026-10-30T04:28:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}