Live › vulnerability › CVE-2026-96386
Go to dashboardThe Drupal Smart Content module is missing an authorization check, so a request can reach content it should not be allowed to view by directly visiting its address. An attacker can read data that the site meant to keep behind access rules.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Drupal sites that run the Smart Content module at version 3.2.1 or earlier are exposed, since the flaw is in the module's access handling. Sites that do not install the module can skip it. Whether a specific site exposes sensitive content depends on what its Smart Content views and pages display, which the sources do not say.
No product ranges from the sources yet.
drupal/smart_content module with composer show drupal/smart_content and see whether it is 3.2.1 or older.drush pm:list --filter=smart_content.drupal/smart_content to a release newer than 3.2.1; the exact fixed version is unknown from the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing. This issue affects Smart Content versions: from 0.0.0 to 3.2.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-96386")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.