{"id":"CVE-2026-114547","kind":"vulnerability","aliases":["CVE-2026-114547"],"related":[],"title":"Drupal TinyPNG module: missing access check lets visitors browse restricted pages","description":"Missing Authorization vulnerability in Drupal TinyPNG allows Forceful Browsing. This issue affects TinyPNG versions: from 0.0.0 to 2.0.2.","summary":"The Drupal TinyPNG module does not enforce authorization on some of its paths, so a user can reach functionality they should not see by requesting the URL directly. The sources do not say what data or actions are exposed beyond that.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","self-hosted","tinypng"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed TinyPNG module version with `drush pm:list --filter=tinypng` or in the Drupal admin under Extend.\n- Confirm whether the site runs the TinyPNG module at all.","fix":"- Drupal TinyPNG module: unknown (sources state affected versions 0.0.0 to 2.0.2 but no fixed version)","status":"open","published_at":"2026-10-30T04:18:14+00:00","first_seen_at":"2026-10-30T04:28:37+00:00","triaged_at":"2026-10-30T04:29:47+00:00","updated_at":"2026-10-30T04:29:47+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-30T04:29:47Z","model":"claude-haiku-5-5","output":{"fix":"- Drupal TinyPNG module: unknown (sources state affected versions 0.0.0 to 2.0.2 but no fixed version)","reach":"internet","title":"Drupal TinyPNG module: missing access check lets visitors browse restricted pages","impact":"low","summary":"The Drupal TinyPNG module does not enforce authorization on some of its paths, so a user can reach functionality they should not see by requesting the URL directly. The sources do not say what data or actions are exposed beyond that.","audience":"businesses","category":"package","nicknames":[],"who_cares":["drupal","tinypng","self-hosted"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized users reach restricted TinyPNG functionality on the site","analyst_note":"Find the Drupal security advisory for TinyPNG and check which routes lack access checks and whether a fixed version exists.","how_to_check":"- Check the installed TinyPNG module version with `drush pm:list --filter=tinypng` or in the Drupal admin under Extend.\n- Confirm whether the site runs the TinyPNG module at all.","plain_action":"","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Drupal sites that have the TinyPNG image compression module installed, at any version listed as affected. The sources do not say which configuration or role is needed to reach the exposed paths.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000677,"input_tokens":4077,"output_tokens":538,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-114547':14A,17A '-2026':13A,16A '0.0.0':79C '2.0.2':81C 'access':5A 'action':60B 'affect':75C 'allow':70C 'author':31B,65C 'beyond':63B 'brows':9A,72C 'check':6A 'cve':12A,15A 'data':58B 'direct':51B 'drupal':1A,18B,25B,68C 'enforc':30B 'expos':62B 'forc':71C 'function':42B 'host':22B 'issu':74C 'let':7A 'miss':4A,64C 'modul':3A,27B 'packag':19B 'page':11A 'path':36B 'reach':41B 'request':48B 'restrict':10A 'say':56B 'see':46B 'self':21B 'self-host':20B 'sourc':53B 'tinypng':2A,23B,26B,69C,76C 'url':50B 'user':39B 'version':77C 'visitor':8A 'vulner':66C","nicknames":[],"mitigations":[],"who_affected":"Drupal sites that have the TinyPNG image compression module installed, at any version listed as affected. The sources do not say which configuration or role is needed to reach the exposed paths.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:18:14+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114547","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114547","severity":null,"published_at":"2026-10-30T04:18:14+00:00","modified_at":"2026-10-30T04:18:14+00:00","first_seen_at":"2026-10-30T04:28:37+00:00","fetched_at":"2026-10-30T04:28:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}