{"id":"CVE-2026-118567","kind":"vulnerability","aliases":["CVE-2026-118567"],"related":[],"title":"Drupal Bulk Update User Roles: forced browsing bypasses authorization checks","description":"Incorrect Authorization vulnerability in Drupal Bulk Update User Roles allows Forceful Browsing. This issue affects Bulk Update User Roles versions: from 0.0.0 to 1.0.5.","summary":"The Drupal Bulk Update User Roles module has an incorrect authorization flaw that lets a user reach functions they should not access by browsing to them directly. The sources give no severity score and do not say which privileges an attacker gains.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bulk-update-user-roles","drupal","package","self-hosted"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed version of the Bulk Update User Roles module in the Drupal site (`drush pm:list --filter=bulk_update_user_roles` or the Extend page)\n- Confirm whether the module is enabled on the site","fix":"- Bulk Update User Roles versions from 0.0.0 to 1.0.5 are affected; the sources do not name a fixed version","status":"open","published_at":"2026-10-30T04:18:22+00:00","first_seen_at":"2026-10-30T04:28:39+00:00","triaged_at":"2026-10-30T04:29:13+00:00","updated_at":"2026-10-30T04:29:13+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T04:29:13Z","model":"claude-haiku-5-5","output":{"fix":"- Bulk Update User Roles versions from 0.0.0 to 1.0.5 are affected; the sources do not name a fixed version\n- unknown","reach":"internet","title":"Drupal Bulk Update User Roles: forced browsing bypasses authorization checks","impact":"medium","summary":"The Drupal Bulk Update User Roles module has an incorrect authorization flaw that lets a user reach functions they should not access by browsing to them directly. The sources give no severity score and do not say which privileges an attacker gains.","audience":"developers","category":"package","nicknames":[],"who_cares":["drupal","bulk-update-user-roles","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown; forced browsing may expose restricted actions on user roles","analyst_note":"Find the Drupal security advisory for Bulk Update User Roles to confirm the fixed version, required privileges and the exact restricted action.","how_to_check":"- Check the installed version of the Bulk Update User Roles module in the Drupal site (`drush pm:list --filter=bulk_update_user_roles` or the Extend page)\n- Confirm whether the module is enabled on the site\n- unknown for any other check, as the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Drupal sites that have the Bulk Update User Roles module installed are in scope, with the affected range given as versions 0.0.0 through 1.0.5. The sources do not say whether the flaw needs an account or a non-default setting, so the exposure of any given site is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000717,"input_tokens":4093,"output_tokens":615,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118567':13A,16A '-2026':12A,15A '0.0.0':90C '1.0.5':92C 'access':48B 'affect':83C 'allow':78C 'attack':67B 'author':9A,37B,70C 'brows':7A,50B,80C 'bulk':2A,18B,29B,74C,84C 'bulk-update-user-rol':17B 'bypass':8A 'check':10A 'cve':11A,14A 'direct':53B 'drupal':1A,22B,28B,73C 'flaw':38B 'forc':6A,79C 'function':44B 'gain':68B 'give':56B 'host':26B 'incorrect':36B,69C 'issu':82C 'let':40B 'modul':33B 'packag':23B 'privileg':65B 'reach':43B 'role':5A,21B,32B,77C,87C 'say':63B 'score':59B 'self':25B 'self-host':24B 'sever':58B 'sourc':55B 'updat':3A,19B,30B,75C,85C 'user':4A,20B,31B,42B,76C,86C 'version':88C 'vulner':71C","nicknames":[],"mitigations":[],"who_affected":"Drupal sites that have the Bulk Update User Roles module installed are in scope, with the affected range given as versions 0.0.0 through 1.0.5. The sources do not say whether the flaw needs an account or a non-default setting, so the exposure of any given site is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T04:18:22+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118567","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118567","severity":null,"published_at":"2026-10-30T04:18:22+00:00","modified_at":"2026-10-30T04:18:22+00:00","first_seen_at":"2026-10-30T04:28:39+00:00","fetched_at":"2026-10-30T04:28:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}