Medium
Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010
Type: advisorySources: OSV
Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*, from 0.0.0 to 11.2.*.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-15916
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 02:33 UTC · Revision 1
Source evidence
Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010
core-osv · Original sourcePublished 25 Aug 2026, 22:22 UTC
Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*, from 0.0.0 to 11.2.*.
osv:CVE-2026-15916
Complete source record
{
"id": "e17f53f69fac79ace3bb444a15174f55354d6ba83f403ebec2a0741b3b1e9112",
"url": "https://osv.dev/vulnerability/CVE-2026-15916",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010",
"summary": "Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*, from 0.0.0 to 11.2.*.",
"evidence": "osv:CVE-2026-15916",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-15916",
"aliases": [
"CVE-2026-15916",
"DRUPAL-CORE-2026-010"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://git.drupalcode.org/project/drupal",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "d5bd34f95553914155b1f64a74ecc184273c8ccf"
},
{
"fixed": "140f94ff1051644c4416c7ed30cc5dd1f14507b2"
},
{
"fixed": "09d3d7fd4a638e3cc53eff60922765ad3af19c66"
},
{
"fixed": "338d58439d5b59d92ac9519ad81ffd916b673841"
},
{
"introduced": "ac5da07ad88571dbb31dfb52f055bb0d4063f598"
},
{
"fixed": "b72f41bba3ab748dc1d4c29eca5e9e7fe97b31eb"
},
{
"introduced": "f68a8e2a206e804342e0b70eae841abc5682b23b"
},
{
"fixed": "1eabaf9ecfc3d2308a12e9146d84bb51bcf0d48b"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0.0.0"
},
{
"fixed": "10.6.13"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"introduced": "0.0.0"
},
{
"fixed": "11.0.*"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"introduced": "0.0.0"
},
{
"fixed": "11.1.*"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"introduced": "0.0.0"
},
{
"fixed": "11.2.*"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"introduced": "11.3.0"
},
{
"fixed": "11.3.14"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"introduced": "11.4.0"
},
{
"fixed": "11.4.4"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
}
]
}
}
],
"versions": [
"10.6.12",
"11.3.13",
"11.4.3",
"11.4.2",
"11.4.1",
"11.4.0",
"10.6.10",
"11.3.11",
"10.6.8",
"11.3.9",
"11.3.8",
"10.6.6",
"11.3.6",
"10.6.5",
"11.3.5",
"10.6.4",
"11.3.4",
"10.6.3",
"11.3.3",
"10.6.2",
"11.3.2",
"11.3.1",
"10.6.1",
"11.3.0",
"10.6.0",
"10.6.0-rc1",
"10.6.0-beta1",
"11.2.0-rc2",
"10.5.0-beta1",
"11.2.0-beta1",
"11.2.0-alpha1",
"11.1.0-rc1",
"11.1.0-beta1",
"11.0.0-beta1",
"11.0.0-alpha1",
"10.1.0-alpha1",
"10.0.0-alpha5",
"10.0.0-alpha4",
"10.0.0-alpha3",
"10.0.0-alpha1",
"9.0.0-alpha2",
"9.0.0-alpha1",
"8.1.0-beta1",
"8.0.0",
"8.0.0-rc4",
"8.0.0-rc3",
"8.0.0-rc2",
"8.0.0-rc1",
"8.0.0-beta16",
"8.0.0-beta15",
"8.0.0-beta14",
"8.0.0-beta13",
"8.0.0-beta12",
"8.0.0-beta11",
"8.0.0-beta10",
"8.0.0-beta9",
"8.0.0-beta7",
"8.0.0-beta6",
"8.0.0-beta5",
"8.0.0-beta4",
"8.0.0-beta3",
"8.0.0-beta2",
"8.0.0-beta1",
"8.0.0-alpha15",
"8.0.0-alpha14",
"8.0-alpha13",
"8.0-alpha12",
"8.0-alpha11",
"8.0-alpha10",
"8.0-alpha9",
"8.0-alpha8",
"8.0-alpha7",
"8.0-alpha6",
"8.0-alpha5",
"8.0-alpha4",
"8.0-alpha3",
"8.0-alpha2",
"7.0",
"7.0-rc-4",
"7.0-rc-3",
"7.0-rc-2",
"7.0-rc-1",
"7.0-beta3",
"7.0-beta2",
"7.0-beta1",
"7.0-alpha7",
"7.0-alpha6",
"7.0-alpha5",
"7.0-alpha4",
"7.0-alpha3",
"7.0-alpha2",
"7.0-alpha1",
"7.0-unstable-10",
"7.0-unstable-7",
"7.0-unstable-6",
"7.0-unstable-5",
"7.0-unstable-4",
"7.0-unstable-3",
"7.0-unstable-2",
"7.0-unstable-1",
"6.0-rc-3",
"6.0-rc-2",
"6.0-rc-1",
"6.0-beta-4",
"6.0-beta-3",
"6.0-beta-2",
"6.0-beta-1",
"5.0-rc-2",
"5.0-rc-1",
"5.0-beta-2",
"5.0-beta-1",
"3.0.1",
"2.0",
"1.0",
"start"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15916.json"
}
}
],
"modified": "2026-10-28T02:30:25.182244590Z",
"provider": "osv",
"references": [
"https://git.drupalcode.org/project/drupal",
"https://www.drupal.org/project/drupal",
"https://www.drupal.org/sa-core-2026-010",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15916.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-15916"
],
"provider_metadata": {
"cwe_ids": [
"CWE-862"
],
"cna_assigner": "drupal",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15916.json"
}
},
"related_cves": [
{
"value": "CVE-2026-15916",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 491939,
"published_at": "2026-08-25T22:22:27.131+00:00"
}