{"id":"CVE-2026-118573","kind":"vulnerability","aliases":["CVE-2026-118573"],"related":[],"title":"Drupal OAuth2 Token Manager: missing authorization lets users browse restricted pages","description":"Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forceful Browsing. This issue affects OAuth2 Token Manager versions: from 0.0.0 to 1.2.0.","summary":"The Drupal OAuth2 Token Manager module fails to check authorization on some pages, so a user can reach content they should not see by browsing to it directly. The sources describe forceful browsing but do not name the affected pages or the data exposed.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","oauth2-token-manager","package","php"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed version of the OAuth2 Token Manager module with `drush pm:list --filter=oauth2_token_manager` or the Drupal extend page\n- Compare against the affected range, which the sources list as versions up to `1.2.0`\n- Review the module's routes and permissions: unknown","fix":"- OAuth2 Token Manager: unknown; the sources do not name a fixed version","status":"open","published_at":"2026-10-30T04:18:23+00:00","first_seen_at":"2026-10-30T04:28:39+00:00","triaged_at":"2026-10-30T04:29:04+00:00","updated_at":"2026-10-30T04:29:04+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-30T04:29:04Z","model":"claude-haiku-5-5","output":{"fix":"- OAuth2 Token Manager: unknown; the sources do not name a fixed version","reach":"internet","title":"Drupal OAuth2 Token Manager: missing authorization lets users browse restricted pages","impact":"medium","summary":"The Drupal OAuth2 Token Manager module fails to check authorization on some pages, so a user can reach content they should not see by browsing to it directly. The sources describe forceful browsing but do not name the affected pages or the data exposed.","audience":"developers","category":"package","nicknames":[],"who_cares":["drupal","oauth2-token-manager","php"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown data reachable by direct URL access","analyst_note":"Find the Drupal security advisory for this CVE to confirm affected routes, required permissions, and the fixed version.","how_to_check":"- Check the installed version of the OAuth2 Token Manager module with `drush pm:list --filter=oauth2_token_manager` or the Drupal extend page\n- Compare against the affected range, which the sources list as versions up to `1.2.0`\n- Review the module's routes and permissions: unknown","plain_action":"","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Sites running the Drupal OAuth2 Token Manager module in the affected version range. The sources do not say which pages lack the check or what data they expose, so the exact exposure is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000685,"input_tokens":4092,"output_tokens":551,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118573':14A,17A '-2026':13A,16A '0.0.0':88C '1.2.0':90C 'affect':63B,82C 'allow':77C 'author':6A,34B,70C 'brows':9A,49B,57B,79C 'check':33B 'content':43B 'cve':12A,15A 'data':67B 'describ':55B 'direct':52B 'drupal':1A,18B,26B,73C 'expos':68B 'fail':31B 'forc':56B,78C 'issu':81C 'let':7A 'manag':4A,22B,29B,76C,85C 'miss':5A,69C 'modul':30B 'name':61B 'oauth2':2A,20B,27B,74C,83C 'oauth2-token-manager':19B 'packag':23B 'page':11A,37B,64B 'php':24B 'reach':42B 'restrict':10A 'see':47B 'sourc':54B 'token':3A,21B,28B,75C,84C 'user':8A,40B 'version':86C 'vulner':71C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Drupal OAuth2 Token Manager module in the affected version range. The sources do not say which pages lack the check or what data they expose, so the exact exposure is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T04:18:23+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118573","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118573","severity":null,"published_at":"2026-10-30T04:18:23+00:00","modified_at":"2026-10-30T04:18:23+00:00","first_seen_at":"2026-10-30T04:28:39+00:00","fetched_at":"2026-10-30T04:28:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}