Live › vulnerability › CVE-2026-114540
The Drupal Domain module, versions 3.0.0 through 3.0.2, has an authorization flaw that lets a user reach pages they should not see by browsing to them directly. The sources do not say what content is exposed or what an attacker can change.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Drupal sites running the Domain module in the affected version range. The sources do not say which configurations or roles make a site exposed.
No product ranges from the sources yet.
drush pm:list or the Extend page) and see whether it falls between 3.0.0 and 3.0.2.3.0.0 to 3.0.2 are affected; the sources do not name the fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incorrect Authorization vulnerability in Drupal Domain allows Forceful Browsing. This issue affects Domain versions: from 3.0.0 to 3.0.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-114540")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.