{"id":"CVE-2026-84910","kind":"vulnerability","aliases":["CVE-2026-84910"],"related":[],"title":"Drupal Advanced Search: missing access check lets users browse restricted pages","description":"Missing Authorization vulnerability in Drupal Advanced Search allows Forceful Browsing. This issue affects Advanced Search versions: from 0.0.0 to 2.4.5.","summary":"The Drupal Advanced Search module is missing an authorization check, so a user can reach pages they should not see by requesting their address directly. The sources describe this as forceful browsing and do not say which data is exposed.","severity":"medium","cvss":4.2,"epss":0.00149,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","self-hosted"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed Advanced Search module version with `drush pm:list --filter=advanced_search` or in the Drupal admin under Extend.\n- unknown for anything else, the sources do not list the affected routes or settings.","fix":"- Upgrade the Advanced Search module to a version newer than `2.4.5`, per the Drupal.org security advisory (the sources do not name the fixed version).","status":"open","published_at":"2026-10-22T02:17:01+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:41:28+00:00","updated_at":"2026-10-25T04:41:28+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T04:41:28Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the Advanced Search module to a version newer than `2.4.5`, per the Drupal.org security advisory (the sources do not name the fixed version).","reach":"internet","title":"Drupal Advanced Search: missing access check lets users browse restricted pages","impact":"medium","summary":"The Drupal Advanced Search module is missing an authorization check, so a user can reach pages they should not see by requesting their address directly. The sources describe this as forceful browsing and do not say which data is exposed.","category":"package","nicknames":[],"who_cares":["drupal","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Restricted search pages or data readable by unauthorized visitors","analyst_note":"Find the Drupal.org security advisory for Advanced Search to confirm the fixed version and which routes or data are exposed.","how_to_check":"- Check the installed Advanced Search module version with `drush pm:list --filter=advanced_search` or in the Drupal admin under Extend.\n- unknown for anything else, the sources do not list the affected routes or settings.","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Sites running the Drupal Advanced Search module at version `2.4.5` or older are in scope according to the NVD entry. The sources do not describe which page or data paths need to be exposed for the flaw to matter, so unknown whether a given site is practically reachable.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.0006,"input_tokens":3317,"output_tokens":537,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-84910':14A,17A '0.0.0':80C '2.4.5':82C 'access':5A 'address':46B 'advanc':2A,25B,68C,76C 'affect':75C 'allow':70C 'author':31B,64C 'brows':9A,54B,72C 'check':6A,32B 'cve':12A,15A 'data':60B 'describ':50B 'direct':47B 'drupal':1A,18B,24B,67C 'expos':62B 'forc':53B,71C 'host':22B 'issu':74C 'let':7A 'miss':4A,29B,63C 'modul':27B 'packag':19B 'page':11A,38B 'reach':37B 'request':44B 'restrict':10A 'say':58B 'search':3A,26B,69C,77C 'see':42B 'self':21B 'self-host':20B 'sourc':49B 'user':8A,35B 'version':78C 'vulner':65C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Drupal Advanced Search module at version `2.4.5` or older are in scope according to the NVD entry. The sources do not describe which page or data paths need to be exposed for the flaw to matter, so unknown whether a given site is practically reachable.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:17:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-84910","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84910","severity":null,"published_at":"2026-10-22T02:17:01+00:00","modified_at":"2026-10-22T16:54:17+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-84910","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-84910","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}