Live › vulnerability › CVE-2026-114544
Drupal Media Bulk Upload versions 0.0.0 through 3.0.6 have an incorrect authorization flaw that allows forceful browsing to restricted resources. The sources do not state what data or actions an attacker can reach beyond that.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Sites running the Drupal Media Bulk Upload module at version 3.0.6 or earlier are in the stated range. The sources do not say which roles or pages are reachable, so unknown whether anonymous visitors can reach the flaw.
No product ranges from the sources yet.
composer show drupal/media_bulk_upload)3.0.6 or earlier3.0.6 (exact fixed version not stated in the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incorrect Authorization vulnerability in Drupal Media Bulk Upload allows Forceful Browsing. This issue affects Media Bulk Upload versions: from 0.0.0 to 3.0.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-114544")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.