Live › vulnerability › CVE-2026-118567
The Drupal Bulk Update User Roles module has an incorrect authorization flaw that lets a user reach functions they should not access by browsing to them directly. The sources give no severity score and do not say which privileges an attacker gains.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Drupal sites that have the Bulk Update User Roles module installed are in scope, with the affected range given as versions 0.0.0 through 1.0.5. The sources do not say whether the flaw needs an account or a non-default setting, so the exposure of any given site is unknown.
No product ranges from the sources yet.
drush pm:list --filter=bulk_update_user_roles or the Extend page)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incorrect Authorization vulnerability in Drupal Bulk Update User Roles allows Forceful Browsing. This issue affects Bulk Update User Roles versions: from 0.0.0 to 1.0.5.
This page as .md · .json · in your agent: get_signal("CVE-2026-118567")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.