Live › vulnerability › CVE-2026-118573
The Drupal OAuth2 Token Manager module fails to check authorization on some pages, so a user can reach content they should not see by browsing to it directly. The sources describe forceful browsing but do not name the affected pages or the data exposed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Sites running the Drupal OAuth2 Token Manager module in the affected version range. The sources do not say which pages lack the check or what data they expose, so the exact exposure is unknown.
No product ranges from the sources yet.
drush pm:list --filter=oauth2_token_manager or the Drupal extend page1.2.0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forceful Browsing. This issue affects OAuth2 Token Manager versions: from 0.0.0 to 1.2.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-118573")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.