{"id":"CVE-2026-114540","kind":"vulnerability","aliases":["CVE-2026-114540"],"related":[],"title":"Drupal Domain module: incorrect authorization lets users force browsing","description":"Incorrect Authorization vulnerability in Drupal Domain allows Forceful Browsing. This issue affects Domain versions: from 3.0.0 to 3.0.2.","summary":"The Drupal Domain module, versions 3.0.0 through 3.0.2, has an authorization flaw that lets a user reach pages they should not see by browsing to them directly. The sources do not say what content is exposed or what an attacker can change.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","php","self-hosted"],"not_affected_if":["unknown"],"how_to_check":"- Check the installed Domain module version in the Drupal site (for example with `drush pm:list` or the Extend page) and see whether it falls between `3.0.0` and `3.0.2`.","fix":"- Domain module `3.0.0` to `3.0.2` are affected; the sources do not name the fixed version.","status":"open","published_at":"2026-10-30T04:18:12+00:00","first_seen_at":"2026-10-30T04:28:37+00:00","triaged_at":"2026-10-30T04:29:53+00:00","updated_at":"2026-10-30T04:29:53+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-30T04:29:53Z","model":"claude-haiku-5-5","output":{"fix":"- Domain module `3.0.0` to `3.0.2` are affected; the sources do not name the fixed version.","reach":"internet","title":"Drupal Domain module: incorrect authorization lets users force browsing","impact":"medium","summary":"The Drupal Domain module, versions 3.0.0 through 3.0.2, has an authorization flaw that lets a user reach pages they should not see by browsing to them directly. The sources do not say what content is exposed or what an attacker can change.","audience":"businesses","category":"package","nicknames":[],"who_cares":["drupal","php","self-hosted"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized users reach restricted pages or content directly","analyst_note":"Find the Drupal security advisory for the Domain module to confirm the fixed version and which content is exposed; source given is only NVD.","how_to_check":"- Check the installed Domain module version in the Drupal site (for example with `drush pm:list` or the Extend page) and see whether it falls between `3.0.0` and `3.0.2`.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Drupal sites running the Domain module in the affected version range. The sources do not say which configurations or roles make a site exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000659,"input_tokens":4072,"output_tokens":504,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-114540':12A,15A '-2026':11A,14A '3.0.0':27B,79C '3.0.2':29B,81C 'affect':75C 'allow':70C 'attack':61B 'author':5A,32B,65C 'brows':9A,45B,72C 'chang':63B 'content':55B 'cve':10A,13A 'direct':48B 'domain':2A,24B,69C,76C 'drupal':1A,16B,23B,68C 'expos':57B 'flaw':33B 'forc':8A,71C 'host':21B 'incorrect':4A,64C 'issu':74C 'let':6A,35B 'modul':3A,25B 'packag':17B 'page':39B 'php':18B 'reach':38B 'say':53B 'see':43B 'self':20B 'self-host':19B 'sourc':50B 'user':7A,37B 'version':26B,77C 'vulner':66C","nicknames":[],"mitigations":[],"who_affected":"Drupal sites running the Domain module in the affected version range. The sources do not say which configurations or roles make a site exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:18:12+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114540","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114540","severity":null,"published_at":"2026-10-30T04:18:12+00:00","modified_at":"2026-10-30T04:18:12+00:00","first_seen_at":"2026-10-30T04:28:37+00:00","fetched_at":"2026-10-30T04:28:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}