{"id":"CVE-2026-96386","kind":"vulnerability","aliases":["CVE-2026-96386"],"related":[],"title":"Drupal Smart Content: missing access check lets visitors browse restricted content","description":"Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing. This issue affects Smart Content versions: from 0.0.0 to 3.2.1.","summary":"The Drupal Smart Content module is missing an authorization check, so a request can reach content it should not be allowed to view by directly visiting its address. An attacker can read data that the site meant to keep behind access rules.","severity":"medium","cvss":6.5,"epss":0.00266,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","drupal-modules","package","php"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed version of the `drupal/smart_content` module with `composer show drupal/smart_content` and see whether it is `3.2.1` or older.\n- Confirm the module is enabled with `drush pm:list --filter=smart_content`.","fix":"- Upgrade `drupal/smart_content` to a release newer than `3.2.1`; the exact fixed version is unknown from the sources.\n- Until upgraded, unknown.","status":"open","published_at":"2026-10-22T02:17:08+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T03:48:38+00:00","updated_at":"2026-10-25T03:48:38+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T03:48:38Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `drupal/smart_content` to a release newer than `3.2.1`; the exact fixed version is unknown from the sources.\n- Until upgraded, unknown.","reach":"internet","title":"Drupal Smart Content: missing access check lets visitors browse restricted content","impact":"medium","summary":"The Drupal Smart Content module is missing an authorization check, so a request can reach content it should not be allowed to view by directly visiting its address. An attacker can read data that the site meant to keep behind access rules.","category":"package","nicknames":[],"who_cares":["drupal","drupal-modules","php"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Visitors read restricted content by requesting its address directly.","analyst_note":"Check the Drupal security advisory for the fixed version and which Smart Content endpoints lack the access check (sources list only NVD and EPSS).","how_to_check":"- Check the installed version of the `drupal/smart_content` module with `composer show drupal/smart_content` and see whether it is `3.2.1` or older.\n- Confirm the module is enabled with `drush pm:list --filter=smart_content`.","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Drupal sites that run the Smart Content module at version 3.2.1 or earlier are exposed, since the flaw is in the module's access handling. Sites that do not install the module can skip it. Whether a specific site exposes sensitive content depends on what its Smart Content views and pages display, which the sources do not say.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00062,"input_tokens":3314,"output_tokens":578,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-96386':14A,17A '0.0.0':83C '3.2.1':85C 'access':5A,64B 'address':51B 'affect':78C 'allow':44B,73C 'attack':53B 'author':32B,67C 'behind':63B 'brows':9A,75C 'check':6A,33B 'content':3A,11A,27B,39B,72C,80C 'cve':12A,15A 'data':56B 'direct':48B 'drupal':1A,18B,20B,25B,70C 'drupal-modul':19B 'forc':74C 'issu':77C 'keep':62B 'let':7A 'meant':60B 'miss':4A,30B,66C 'modul':21B,28B 'packag':22B 'php':23B 'reach':38B 'read':55B 'request':36B 'restrict':10A 'rule':65B 'site':59B 'smart':2A,26B,71C,79C 'version':81C 'view':46B 'visit':49B 'visitor':8A 'vulner':68C","nicknames":[],"mitigations":[],"who_affected":"Drupal sites that run the Smart Content module at version 3.2.1 or earlier are exposed, since the flaw is in the module's access handling. Sites that do not install the module can skip it. Whether a specific site exposes sensitive content depends on what its Smart Content views and pages display, which the sources do not say.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96386","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96386","severity":null,"published_at":"2026-10-22T02:17:08+00:00","modified_at":"2026-10-22T16:54:17+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-96386","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96386","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}