{"id":"CVE-2026-118569","kind":"vulnerability","aliases":["CVE-2026-118569"],"related":[],"title":"Drupal Fasttoggle: incorrect authorization lets users browse forbidden pages","description":"Incorrect Authorization vulnerability in Drupal Fasttoggle allows Forceful Browsing. This issue affects Fasttoggle versions: from 0.0.0 to 4.1.1.","summary":"Drupal's Fasttoggle module has an incorrect authorization flaw that lets a user reach pages or actions they should not be allowed to access. The sources do not say what data or actions an attacker gets beyond that.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","fasttoggle","package","php"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check whether the `fasttoggle` module is installed in the Drupal site, for example with `drush pm:list --filter=fasttoggle`\n- Note the installed version and compare it to the affected range (0.0.0 to 4.1.1)","fix":"- Fasttoggle versions from 0.0.0 to 4.1.1 are affected; the sources do not name a fixed version","status":"open","published_at":"2026-10-30T04:18:22+00:00","first_seen_at":"2026-10-30T04:28:39+00:00","triaged_at":"2026-10-30T04:29:08+00:00","updated_at":"2026-10-30T04:29:08+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T04:29:08Z","model":"claude-haiku-5-5","output":{"fix":"- Fasttoggle versions from 0.0.0 to 4.1.1 are affected; the sources do not name a fixed version","reach":"internet","title":"Drupal Fasttoggle: incorrect authorization lets users browse forbidden pages","impact":"medium","summary":"Drupal's Fasttoggle module has an incorrect authorization flaw that lets a user reach pages or actions they should not be allowed to access. The sources do not say what data or actions an attacker gets beyond that.","audience":"developers","category":"package","nicknames":[],"who_cares":["drupal","fasttoggle","php"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown; forced browsing grants access to restricted pages","analyst_note":"Find the fixed Fasttoggle version and the affected permission or route from the Drupal security advisory for this CVE.","how_to_check":"- Check whether the `fasttoggle` module is installed in the Drupal site, for example with `drush pm:list --filter=fasttoggle`\n- Note the installed version and compare it to the affected range (0.0.0 to 4.1.1)","plain_action":"","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Drupal sites that run the Fasttoggle module in the affected version range are exposed. Sites without this module are not affected. The sources do not say which configuration or role makes the flaw reachable.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00068,"input_tokens":4084,"output_tokens":544,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118569':12A,15A '-2026':11A,14A '0.0.0':72C '4.1.1':74C 'access':43B 'action':36B,52B 'affect':68C 'allow':41B,63C 'attack':54B 'author':4A,27B,58C 'beyond':56B 'brows':7A,65C 'cve':10A,13A 'data':50B 'drupal':1A,16B,20B,61C 'fasttoggl':2A,17B,22B,62C,69C 'flaw':28B 'forbidden':8A 'forc':64C 'get':55B 'incorrect':3A,26B,57C 'issu':67C 'let':5A,30B 'modul':23B 'packag':18B 'page':9A,34B 'php':19B 'reach':33B 'say':48B 'sourc':45B 'user':6A,32B 'version':70C 'vulner':59C","nicknames":[],"mitigations":[],"who_affected":"Drupal sites that run the Fasttoggle module in the affected version range are exposed. Sites without this module are not affected. The sources do not say which configuration or role makes the flaw reachable.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T04:18:22+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118569","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118569","severity":null,"published_at":"2026-10-30T04:18:22+00:00","modified_at":"2026-10-30T04:18:22+00:00","first_seen_at":"2026-10-30T04:28:39+00:00","fetched_at":"2026-10-30T04:28:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}