{"id":"CVE-2026-114571","kind":"vulnerability","aliases":["CVE-2026-114571"],"related":[],"title":"Drupal Rabbit Hole: incorrect authorization lets users browse restricted content","description":"Incorrect Authorization vulnerability in Drupal Rabbit Hole allows Forceful Browsing. This issue affects Rabbit Hole versions: from 0.0.0 to 1.3.0.","summary":"Drupal Rabbit Hole, a module that controls how entities are displayed, has an incorrect authorization flaw that allows forceful browsing. An attacker may reach pages or entities they should not be able to view.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","php","rabbit-hole"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed Rabbit Hole version in the Drupal project (for example with `composer show drupal/rabbit_hole`).\n- Confirm whether the site uses Rabbit Hole to hide or redirect entities.","fix":"- Move Rabbit Hole past `1.3.0`; the sources do not name the fixed version.","status":"open","published_at":"2026-10-30T04:18:17+00:00","first_seen_at":"2026-10-30T04:28:38+00:00","triaged_at":"2026-10-30T04:29:41+00:00","updated_at":"2026-10-30T04:29:41+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T04:29:41Z","model":"claude-haiku-5-5","output":{"fix":"- Move Rabbit Hole past `1.3.0`; the sources do not name the fixed version.","reach":"internet","title":"Drupal Rabbit Hole: incorrect authorization lets users browse restricted content","impact":"medium","summary":"Drupal Rabbit Hole, a module that controls how entities are displayed, has an incorrect authorization flaw that allows forceful browsing. An attacker may reach pages or entities they should not be able to view.","audience":"developers","category":"package","nicknames":[],"who_cares":["drupal","rabbit-hole","php"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized users can view content meant to be hidden","analyst_note":"Confirm the fixed Rabbit Hole version and whether authentication is required, using the Drupal security advisory for this CVE.","how_to_check":"- Check the installed Rabbit Hole version in the Drupal project (for example with `composer show drupal/rabbit_hole`).\n- Confirm whether the site uses Rabbit Hole to hide or redirect entities.","plain_action":"","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Drupal sites that run the Rabbit Hole module, version 1.3.0 or earlier, to control access to entity pages. Sites without the module are not affected. The sources do not describe further conditions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000674,"input_tokens":4087,"output_tokens":531,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-114571':13A,16A '-2026':12A,15A '0.0.0':74C '1.3.0':76C 'abl':54B 'affect':69C 'allow':40B,64C 'attack':44B 'author':5A,37B,58C 'brows':8A,42B,66C 'content':10A 'control':29B 'cve':11A,14A 'display':33B 'drupal':1A,17B,23B,61C 'entiti':31B,49B 'flaw':38B 'forc':41B,65C 'hole':3A,22B,25B,63C,71C 'incorrect':4A,36B,57C 'issu':68C 'let':6A 'may':45B 'modul':27B 'packag':18B 'page':47B 'php':19B 'rabbit':2A,21B,24B,62C,70C 'rabbit-hol':20B 'reach':46B 'restrict':9A 'user':7A 'version':72C 'view':56B 'vulner':59C","nicknames":[],"mitigations":[],"who_affected":"Drupal sites that run the Rabbit Hole module, version 1.3.0 or earlier, to control access to entity pages. Sites without the module are not affected. The sources do not describe further conditions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T04:18:17+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114571","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114571","severity":null,"published_at":"2026-10-30T04:18:17+00:00","modified_at":"2026-10-30T04:18:17+00:00","first_seen_at":"2026-10-30T04:28:38+00:00","fetched_at":"2026-10-30T04:28:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}