CVE-2026-15916

MediumCVSS 4.2/10Last modified Aug 28, 2026

Description

Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*, from 0.0.0 to 11.2.*.

Metrics

CVSS 3.1 4.2/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-862

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Drupal	Drupal core	>= 0.0.0, < 10.6.13; >= 11.3.0, < 11.3.14; >= 11.4.0, < 11.4.4; >= 0.0.0, < 11.0.; >= 0.0.0, < 11.1.; >= 0.0.0, < 11.2.*

References

https://www.drupal.org/sa-core-2026-010

Timeline

Published: Aug 25, 2026
Last modified: Aug 28, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-159174.7Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site S CVE-2026-159187.5VikAppointments Service Booking Calendar wordpress plugin is vulnerable to unauthenticated SQL injection due to one of the parameters that c CVE-2026-15925.4Foxit PDF Editor Cloud (pdfonline) contains a stored cross-site scripting vulnerability in the Create New Layer feature. Unsanitized user in CVE-2026-159206.1An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.contrib.admin.utils.display_for_field()` renders `URLField CVE-2026-159213.1Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.32.1 through 0.40.5, `n CVE-2026-159234.6The Zephyr SDIO subsystem function sdio_io_rw_extended_helper() in subsys/sd/sdio.c finishes transfers with a byte-I/O loop that uses size =CVE-2026-159245.9Zephyr's TLS socket layer in subsys/net/lib/sockets/sockets_tls.c keeps a single process-global array, client_cache, of cached client sessio CVE-2026-159259.2Improper TLS hostname verification in Snowflake Connector for Python versions prior to 4.7.1 and 3.18.1 may have allowed a network-positione CVE-2026-159276.8A flaw was found in Red Hat Quay's repository-level mirror configuration feature. The POST and PUT handlers in endpoints/api/mirror.py accep CVE-2026-159288.2XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting (XSS) vulnerability in the error page comp CVE-2026-159297.1Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in LG Electronics SmartShare allows SQL I CVE-2026-15939.8A weakness has been identified in itsourcecode Society Management System 1.0. Affected by this vulnerability is an unknown functionality of