CVE-2026-114544: Media Bulk Upload - Moderately critical - Access bypass - SA-CONTRIB-2026-243
Published Oct 30, 2026
·Updated
Incorrect Authorization vulnerability in Drupal Media Bulk Upload allows Forceful Browsing. This issue affects Media Bulk Upload versions: from 0.0.0 to 3.0.6.
Affected Software
1 affected component
Drupal Media Bulk Upload>=0.0.0<=3.0.6
Event History
Oct 30, 2026
CVE Published
via MITRE·03:09 AM
Data Sourced
via MITRE·03:09 AM
DescriptionWeakness
Data Sourced
via OSV·03:09 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:18 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which installations are affected?
Media Bulk Upload versions from 0.0.0 through 3.0.6 are affected.
2
What type of access control issue is involved?
The vulnerability is an incorrect authorization issue that allows forceful browsing.