CVE-2026-114530: Dopup - Critical - Information disclosure - SA-CONTRIB-2026-227
Published Oct 30, 2026
·Updated
Incorrect Authorization vulnerability in Drupal Dopup allows Forceful Browsing. This issue affects Dopup versions: from 0.0.0 to 1.0.7.
Affected Software
1 affected component
Drupal Dopup>=0.0.0<=1.0.7
Event History
Oct 30, 2026
CVE Published
via MITRE·03:09 AM
Data Sourced
via MITRE·03:09 AM
DescriptionWeakness
Data Sourced
via OSV·03:09 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:18 AM
DescriptionWeakness
Nov 6, 2026
Data Sourced
via NVD·04:17 PM
Severity
Frequently Asked Questions
1
Which Dopup versions should be treated as affected?
Dopup versions from 0.0.0 through 1.0.7 are identified as affected.
2
Does the supplied advisory data identify a fixed release or temporary mitigation?
No fixed release, workaround, or mitigation is provided in the supplied data.