CVE-2026-107267: DKAN - Moderately critical - Access bypass - SA-CONTRIB-2026-208

Published Oct 30, 2026

Updated

Missing Authorization vulnerability in Drupal DKAN allows Forceful Browsing. This issue affects DKAN versions: from 0.0.0 to 4.0.4, from 4.1.0 to 4.1.5.

Event History

Oct 30, 2026

CVE Published

via MITRE·03:10 AM

Data Sourced

via MITRE·03:10 AM

DescriptionWeakness

Data Sourced

via NVD·04:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which DKAN versions are affected?

Affected versions are 0.0.0 through 4.0.4 and 4.1.0 through 4.1.5. The provided information does not identify affected versions outside those ranges.

Does exploitation require authentication or user interaction?

No. The supplied CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.

What is the potential impact of successful exploitation?

The CVSS vector indicates low confidentiality impact, with no integrity or availability impact. The vulnerability is described as an authorization bypass through forceful browsing.

CVE-2026-107267: DKAN - Moderately critical - Access bypass - SA-CONTRIB-2026-208

Event History

Frequently Asked Questions

Which DKAN versions are affected?

Does exploitation require authentication or user interaction?

What is the potential impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which DKAN versions are affected?

Does exploitation require authentication or user interaction?

What is the potential impact of successful exploitation?