{"id":"CVE-2026-114544","kind":"vulnerability","aliases":["CVE-2026-114544"],"related":[],"title":"Drupal Media Bulk Upload: missing authorization lets users browse restricted pages","description":"Incorrect Authorization vulnerability in Drupal Media Bulk Upload allows Forceful Browsing. This issue affects Media Bulk Upload versions: from 0.0.0 to 3.0.6.","summary":"Drupal Media Bulk Upload versions 0.0.0 through 3.0.6 have an incorrect authorization flaw that allows forceful browsing to restricted resources. The sources do not state what data or actions an attacker can reach beyond that.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","media-bulk-upload","runtime","self-hosted"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed Media Bulk Upload version in the Drupal project (for example with `composer show drupal/media_bulk_upload`)\n- Confirm whether the version is `3.0.6` or earlier","fix":"- Media Bulk Upload: move to a version later than `3.0.6` (exact fixed version not stated in the sources)","status":"open","published_at":"2026-10-30T04:18:14+00:00","first_seen_at":"2026-10-30T04:28:37+00:00","triaged_at":"2026-10-30T04:29:50+00:00","updated_at":"2026-10-30T04:29:50+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-30T04:29:50Z","model":"claude-haiku-5-5","output":{"fix":"- Media Bulk Upload: move to a version later than `3.0.6` (exact fixed version not stated in the sources)","reach":"internet","title":"Drupal Media Bulk Upload: missing authorization lets users browse restricted pages","impact":"medium","summary":"Drupal Media Bulk Upload versions 0.0.0 through 3.0.6 have an incorrect authorization flaw that allows forceful browsing to restricted resources. The sources do not state what data or actions an attacker can reach beyond that.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["drupal","media-bulk-upload","self-hosted"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown access to restricted upload functions and content","analyst_note":"Sources give only the NVD description; check the Drupal security advisory for the fixed version, required role and what the forceful browsing exposes.","how_to_check":"- Check the installed Media Bulk Upload version in the Drupal project (for example with `composer show drupal/media_bulk_upload`)\n- Confirm whether the version is `3.0.6` or earlier\n- unknown whether any other check applies","plain_action":"","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Sites running the Drupal Media Bulk Upload module at version 3.0.6 or earlier are in the stated range. The sources do not say which roles or pages are reachable, so unknown whether anonymous visitors can reach the flaw.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000699,"input_tokens":4090,"output_tokens":580,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-114544':14A,17A '-2026':13A,16A '0.0.0':32B,80C '3.0.6':34B,82C 'action':55B 'affect':74C 'allow':41B,69C 'attack':57B 'author':6A,38B,62C 'beyond':60B 'brows':9A,43B,71C 'bulk':3A,21B,29B,67C,76C 'cve':12A,15A 'data':53B 'drupal':1A,18B,27B,65C 'flaw':39B 'forc':42B,70C 'host':26B 'incorrect':37B,61C 'issu':73C 'let':7A 'media':2A,20B,28B,66C,75C 'media-bulk-upload':19B 'miss':5A 'page':11A 'reach':59B 'resourc':46B 'restrict':10A,45B 'runtim':23B 'self':25B 'self-host':24B 'sourc':48B 'state':51B 'upload':4A,22B,30B,68C,77C 'user':8A 'version':31B,78C 'vulner':63C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Drupal Media Bulk Upload module at version 3.0.6 or earlier are in the stated range. The sources do not say which roles or pages are reachable, so unknown whether anonymous visitors can reach the flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:18:14+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114544","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114544","severity":null,"published_at":"2026-10-30T04:18:14+00:00","modified_at":"2026-10-30T04:18:14+00:00","first_seen_at":"2026-10-30T04:28:37+00:00","fetched_at":"2026-10-30T04:28:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}