---
id: "CVE-2026-114544"
kind: "vulnerability"
aliases: ["CVE-2026-114544"]
title: "Drupal Media Bulk Upload: missing authorization lets users browse restricted pages"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["drupal", "media-bulk-upload", "runtime", "self-hosted"]
not_affected_if: ["module-not-installed"]
published_at: "2026-10-30T04:18:14+00:00"
first_seen_at: "2026-10-30T04:28:37+00:00"
updated_at: "2026-10-30T04:29:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114544", "first_seen_at": "2026-10-30T04:28:37+00:00"}]
---

# Drupal Media Bulk Upload: missing authorization lets users browse restricted pages

Drupal Media Bulk Upload versions 0.0.0 through 3.0.6 have an incorrect authorization flaw that allows forceful browsing to restricted resources. The sources do not state what data or actions an attacker can reach beyond that.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Media Bulk Upload version in the Drupal project (for example with `composer show drupal/media_bulk_upload`)
- Confirm whether the version is `3.0.6` or earlier

## Fix

- Media Bulk Upload: move to a version later than `3.0.6` (exact fixed version not stated in the sources)

## Timeline

- 2026-10-30T04:28:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114544

## From the sources

Incorrect Authorization vulnerability in Drupal Media Bulk Upload allows Forceful Browsing. This issue affects Media Bulk Upload versions: from 0.0.0 to 3.0.6.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_