Live › vulnerability › CVE-2026-87943
Go to dashboardThe Drupal SAML SSO - Service Provider module lacks an authorization check, so a user can reach pages they should not see by browsing to them directly. Versions 0.0.0 through 3.2.0 are listed as affected.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Drupal SAML SSO - Service Provider module at version 3.2.0 or earlier are affected. Sites that do not use this module can skip it. The sources do not say which routes are exposed or whether anonymous users can reach them.
No product ranges from the sources yet.
drush pm:list --filter=saml3.2.0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in Drupal SAML SSO - Service Provider allows Forceful Browsing. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-87943")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.