CVE-2026-107257: Actstream - Critical - Access bypass - SA-CONTRIB-2026-198
Published Oct 30, 2026
·Updated
Incorrect Authorization vulnerability in Drupal Actstream allows Forceful Browsing. This issue affects Actstream versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1.
Event History
Oct 30, 2026
CVE Published
via MITRE·03:10 AM
Data Sourced
via MITRE·03:10 AM
DescriptionWeakness
Data Sourced
via NVD·04:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments should be treated as affected?
Drupal deployments using Actstream versions from 0.0.0 through 2.0.1, or from 2.1.0 through 2.1.1, are affected. Check the installed Actstream module version against these ranges.
2
What does an attacker need to exploit this issue?
The supplied CVSS vector indicates the issue is exploitable over the network with low attack complexity, without privileges or user interaction. The vulnerability is an authorization bypass involving forceful browsing.