{"id":"CVE-2026-114543","kind":"vulnerability","aliases":["CVE-2026-114543"],"related":[],"title":"Drupal Simple User Management: incorrect authorization allows forceful browsing","description":"Incorrect Authorization vulnerability in Drupal Simple User Management allows Forceful Browsing. This issue affects Simple User Management versions: from 0.0.0 to 1.11.0.","summary":"Simple User Management, a Drupal module, has an incorrect authorization check that lets a user reach pages they should not see by browsing directly to their URLs. The sources do not say what data or actions are exposed.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","simple-user-management"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed version of the Simple User Management module in the Drupal site (`drush pm:list --filter=simple_user_management` or the Extend page), where unknown if the sources do not give the exact command.","fix":"- Simple User Management versions from 0.0.0 to 1.11.0 are affected; the sources do not name a fixed version.","status":"open","published_at":"2026-10-30T04:18:13+00:00","first_seen_at":"2026-10-30T04:28:37+00:00","triaged_at":"2026-10-30T04:29:52+00:00","updated_at":"2026-10-30T04:29:52+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-30T04:29:52Z","model":"claude-haiku-5-5","output":{"fix":"- Simple User Management versions from 0.0.0 to 1.11.0 are affected; the sources do not name a fixed version.","reach":"internet","title":"Drupal Simple User Management: incorrect authorization allows forceful browsing","impact":"medium","summary":"Simple User Management, a Drupal module, has an incorrect authorization check that lets a user reach pages they should not see by browsing directly to their URLs. The sources do not say what data or actions are exposed.","audience":"developers","category":"package","nicknames":[],"who_cares":["drupal","simple-user-management"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown; sources do not state what data is exposed","analyst_note":"Find the Drupal security advisory or the NVD entry details for the affected pages, the required role, and the fixed version.","how_to_check":"- Check the installed version of the Simple User Management module in the Drupal site (`drush pm:list --filter=simple_user_management` or the Extend page), where unknown if the sources do not give the exact command.\n- unknown for any other check, the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Drupal sites that run the Simple User Management module in versions 0.0.0 through 1.11.0 are in scope. The sources do not say which configuration or roles are needed to reach the affected pages, so the exposure is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00068,"input_tokens":4081,"output_tokens":544,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-114543':12A,15A '-2026':11A,14A '0.0.0':79C '1.11.0':81C 'action':57B 'affect':73C 'allow':7A,68C 'author':6A,31B,61C 'brows':9A,44B,70C 'check':32B 'cve':10A,13A 'data':55B 'direct':45B 'drupal':1A,16B,26B,64C 'expos':59B 'forc':8A,69C 'incorrect':5A,30B,60C 'issu':72C 'let':34B 'manag':4A,21B,24B,67C,76C 'modul':27B 'packag':17B 'page':38B 'reach':37B 'say':53B 'see':42B 'simpl':2A,19B,22B,65C,74C 'simple-user-manag':18B 'sourc':50B 'url':48B 'user':3A,20B,23B,36B,66C,75C 'version':77C 'vulner':62C","nicknames":[],"mitigations":[],"who_affected":"Drupal sites that run the Simple User Management module in versions 0.0.0 through 1.11.0 are in scope. The sources do not say which configuration or roles are needed to reach the affected pages, so the exposure is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T04:18:13+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114543","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114543","severity":null,"published_at":"2026-10-30T04:18:13+00:00","modified_at":"2026-10-30T04:18:13+00:00","first_seen_at":"2026-10-30T04:28:37+00:00","fetched_at":"2026-10-30T04:28:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}