Live › vulnerability › CVE-2026-84910
Go to dashboardThe Drupal Advanced Search module is missing an authorization check, so a user can reach pages they should not see by requesting their address directly. The sources describe this as forceful browsing and do not say which data is exposed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Drupal Advanced Search module at version or older are in scope according to the NVD entry. The sources do not describe which page or data paths need to be exposed for the flaw to matter, so unknown whether a given site is practically reachable.
2.4.5No product ranges from the sources yet.
drush pm:list --filter=advanced_search or in the Drupal admin under Extend.2.4.5, per the Drupal.org security advisory (the sources do not name the fixed version).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in Drupal Advanced Search allows Forceful Browsing. This issue affects Advanced Search versions: from 0.0.0 to 2.4.5.
This page as .md · .json · in your agent: get_signal("CVE-2026-84910")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.