Description
Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing. This issue affects Smart Content versions: from 0.0.0 to 3.2.1.
Published: 2026-10-22
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Access
Action: Patch Now
AI Analysis

Impact

This vulnerability is a missing authorization flaw that allows forceful browsing of pages controlled by Drupal Smart Content. An authenticated session is not required, and the flaw is classified under CWE-862. Attackers could request any content that is normally protected by the module.

Affected Systems

The issue affects Drupal Smart Content modules from version 0.0.0 up through 3.2.1. Systems running any of these versions are vulnerable regardless of other configurations.

Risk and Exploitability

There are no publicly available exploit packages, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score is 6.5 and the EPSS score is less than 1%, indicating a moderate severity with a low exploitation probability. The likely attack vector is remote network access, and the vulnerability can be bypassed without authenticating.

Generated by OpenCVE AI on November 4, 2026 at 11:22 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Drupal Smart Content to a version newer than 3.2.1.
  • Apply any vendor-provided access control configuration to restrict crawling of protected URLs.
  • Deploy a web‑application firewall or reverse‑proxy rule to block requests to known protected paths until the module is patched.

Generated by OpenCVE AI on November 4, 2026 at 11:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://www.drupal.org/sa-contrib-2026-190 cve-icon cve-icon
History

Tue, 03 Nov 2026 23:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

 cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 09:30:00 +0000

Type Values Removed Values Added
First Time appeared Drupal
Drupal smart Content
Vendors & Products Drupal
Drupal smart Content

Thu, 22 Oct 2026 01:45:00 +0000

Type Values Removed Values Added
Description Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing. This issue affects Smart Content versions: from 0.0.0 to 3.2.1.
Title Smart Content - Moderately critical - Access bypass - SA-CONTRIB-2026-190
Weaknesses CWE-862
References

Subscriptions

Drupal Smart Content
cve-icon MITRE

Status: PUBLISHED

Assigner: drupal

Published:

Updated: 2026-11-03T22:23:38.844Z

Reserved: 2026-09-23T01:32:48.997Z

Link: CVE-2026-96386

cve-icon Vulnrichment

Updated: 2026-10-22T13:52:17.966Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-22T02:17:08.873

Modified: 2026-10-22T16:54:17.390

Link: CVE-2026-96386

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-04T11:30:10Z

Weaknesses