{"id":"CVE-2026-114553","kind":"vulnerability","aliases":["CVE-2026-114553"],"related":[],"title":"Drupal Frontend Editing: incorrect authorization allows forceful browsing","description":"Incorrect Authorization vulnerability in Drupal Frontend Editing allows Forceful Browsing. This issue affects Frontend Editing versions: from 0.0.0 to 1.9.3.","summary":"The Drupal Frontend Editing module has an authorization flaw that lets a user reach pages they should not see by browsing to them directly. The sources do not say what data or actions are exposed beyond that.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","frontend-editing","package","self-hosted"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed Frontend Editing module version in the Drupal project (for example with `composer show drupal/frontend_editing` if it is a Composer install).","fix":"- Move Frontend Editing past `1.9.3` (the affected range is `0.0.0` to `1.9.3`).","status":"open","published_at":"2026-10-30T04:18:15+00:00","first_seen_at":"2026-10-30T04:28:37+00:00","triaged_at":"2026-10-30T04:29:45+00:00","updated_at":"2026-10-30T04:29:45+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T04:29:45Z","model":"claude-haiku-5-5","output":{"fix":"- Move Frontend Editing past `1.9.3` (the affected range is `0.0.0` to `1.9.3`).","reach":"internet","title":"Drupal Frontend Editing: incorrect authorization allows forceful browsing","impact":"medium","summary":"The Drupal Frontend Editing module has an authorization flaw that lets a user reach pages they should not see by browsing to them directly. The sources do not say what data or actions are exposed beyond that.","audience":"businesses","category":"package","nicknames":[],"who_cares":["drupal","frontend-editing","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Unauthorized users may access restricted content or editing pages.","analyst_note":"Confirm the fixed version and required roles or configuration from the NVD entry or the Drupal security advisory for CVE-2026-114553.","how_to_check":"- Check the installed Frontend Editing module version in the Drupal project (for example with `composer show drupal/frontend_editing` if it is a Composer install).\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Drupal sites that run the Frontend Editing module at a version within the affected range. The sources do not describe the exact configuration or roles needed to be exposed, so the exposure scope is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000668,"input_tokens":4084,"output_tokens":520,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-114553':11A,14A '-2026':10A,13A '0.0.0':76C '1.9.3':78C 'action':55B 'affect':71C 'allow':6A,66C 'author':5A,30B,60C 'beyond':58B 'brows':8A,43B,68C 'cve':9A,12A 'data':53B 'direct':46B 'drupal':1A,15B,24B,63C 'edit':3A,18B,26B,65C,73C 'expos':57B 'flaw':31B 'forc':7A,67C 'frontend':2A,17B,25B,64C,72C 'frontend-edit':16B 'host':22B 'incorrect':4A,59C 'issu':70C 'let':33B 'modul':27B 'packag':19B 'page':37B 'reach':36B 'say':51B 'see':41B 'self':21B 'self-host':20B 'sourc':48B 'user':35B 'version':74C 'vulner':61C","nicknames":[],"mitigations":[],"who_affected":"Drupal sites that run the Frontend Editing module at a version within the affected range. The sources do not describe the exact configuration or roles needed to be exposed, so the exposure scope is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:18:15+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114553","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114553","severity":null,"published_at":"2026-10-30T04:18:15+00:00","modified_at":"2026-10-30T04:18:15+00:00","first_seen_at":"2026-10-30T04:28:37+00:00","fetched_at":"2026-10-30T04:28:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}