{"id":"CVE-2026-87943","kind":"vulnerability","aliases":["CVE-2026-87943"],"related":[],"title":"Drupal SAML SSO module: missing authorization lets users force pages","description":"Missing Authorization vulnerability in Drupal SAML SSO - Service Provider  allows Forceful Browsing. This issue affects SAML SSO - Service Provider  versions: from 0.0.0 to 3.2.0.","summary":"The Drupal SAML SSO - Service Provider module lacks an authorization check, so a user can reach pages they should not see by browsing to them directly. Versions 0.0.0 through 3.2.0 are listed as affected.","severity":"medium","cvss":6.5,"epss":0.00194,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","saml","self-hosted","sso"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed version of the Drupal SAML SSO - Service Provider module, for example with `drush pm:list --filter=saml`\n- unknown for any further configuration check, as the sources do not say which pages are exposed","fix":"- Upgrade the SAML SSO - Service Provider module to a version above `3.2.0`\n- unknown for the exact fixed version, as the sources do not say","status":"open","published_at":"2026-10-22T02:17:03+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T03:48:38+00:00","updated_at":"2026-10-25T03:48:38+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T03:48:38Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the SAML SSO - Service Provider module to a version above `3.2.0`\n- unknown for the exact fixed version, as the sources do not say","reach":"internet","title":"Drupal SAML SSO module: missing authorization lets users force pages","impact":"medium","summary":"The Drupal SAML SSO - Service Provider module lacks an authorization check, so a user can reach pages they should not see by browsing to them directly. Versions 0.0.0 through 3.2.0 are listed as affected.","category":"package","nicknames":[],"who_cares":["drupal","saml","sso","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Users reach SAML pages they should not access directly","analyst_note":"Check the NVD entry and Drupal security advisory for the affected routes, whether anonymous access is possible, and the first fixed version.","how_to_check":"- Check the installed version of the Drupal SAML SSO - Service Provider module, for example with `drush pm:list --filter=saml`\n- unknown for any further configuration check, as the sources do not say which pages are exposed","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Sites running the Drupal SAML SSO - Service Provider module at version 3.2.0 or earlier are affected. Sites that do not use this module can skip it. The sources do not say which routes are exposed or whether anonymous users can reach them.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000604,"input_tokens":3337,"output_tokens":541,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-87943':13A,16A '0.0.0':51B,79C '3.2.0':53B,81C 'affect':57B,72C 'allow':67C 'author':6A,33B,59C 'brows':46B,69C 'check':34B 'cve':11A,14A 'direct':49B 'drupal':1A,17B,25B,62C 'forc':9A,68C 'host':22B 'issu':71C 'lack':31B 'let':7A 'list':55B 'miss':5A,58C 'modul':4A,30B 'packag':18B 'page':10A,40B 'provid':29B,66C,76C 'reach':39B 'saml':2A,19B,26B,63C,73C 'see':44B 'self':21B 'self-host':20B 'servic':28B,65C,75C 'sso':3A,23B,27B,64C,74C 'user':8A,37B 'version':50B,77C 'vulner':60C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Drupal SAML SSO - Service Provider module at version 3.2.0 or earlier are affected. Sites that do not use this module can skip it. The sources do not say which routes are exposed or whether anonymous users can reach them.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:17:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87943","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87943","severity":null,"published_at":"2026-10-22T02:17:03+00:00","modified_at":"2026-10-22T17:17:00+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-87943","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87943","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}