Live › vulnerability › CVE-2026-114571
Drupal Rabbit Hole, a module that controls how entities are displayed, has an incorrect authorization flaw that allows forceful browsing. An attacker may reach pages or entities they should not be able to view.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Drupal sites that run the Rabbit Hole module, version 1.3.0 or earlier, to control access to entity pages. Sites without the module are not affected. The sources do not describe further conditions.
No product ranges from the sources yet.
composer show drupal/rabbit_hole).1.3.0; the sources do not name the fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incorrect Authorization vulnerability in Drupal Rabbit Hole allows Forceful Browsing. This issue affects Rabbit Hole versions: from 0.0.0 to 1.3.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-114571")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.