Live › vulnerability › CVE-2026-114547
The Drupal TinyPNG module does not enforce authorization on some of its paths, so a user can reach functionality they should not see by requesting the URL directly. The sources do not say what data or actions are exposed beyond that.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Drupal sites that have the TinyPNG image compression module installed, at any version listed as affected. The sources do not say which configuration or role is needed to reach the exposed paths.
No product ranges from the sources yet.
drush pm:list --filter=tinypng or in the Drupal admin under Extend.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in Drupal TinyPNG allows Forceful Browsing. This issue affects TinyPNG versions: from 0.0.0 to 2.0.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-114547")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.