CVE-2026-73477: Quick Tabs - Moderately critical - Access bypass - SA-CONTRIB-2026-099

Q: Which installations are affected?

Quick Tabs versions from 0.0.0 through 4.3.1 are affected. Installations using a version outside that range are not identified as affected by the provided information.

Q: What level of access does an attacker need?

The vulnerability is remotely exploitable with low attack complexity and requires no privileges or user interaction. Successful exploitation can expose limited confidential information, with no stated integrity or availability impact.

Published Sep 2, 2026

Updated

Incorrect Authorization vulnerability in Drupal Quick Tabs allows Forceful Browsing. This issue affects Quick Tabs versions: from 0.0.0 to 4.3.1.

Affected Software

1 affected component

Quick Tabs>=0.0.0<=4.3.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade drupal/quick-tabs to a version that resolves this vulnerability.
Fixed in 4.3.1Patch SA-CONTRIB-2026-099

Event History

Sep 2, 2026

CVE Published

via MITRE·12:32 PM

Data Sourced

via MITRE·12:32 PM

DescriptionWeakness

Data Sourced

via NVD·01:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

Quick Tabs versions from 0.0.0 through 4.3.1 are affected. Installations using a version outside that range are not identified as affected by the provided information.

What level of access does an attacker need?

The vulnerability is remotely exploitable with low attack complexity and requires no privileges or user interaction. Successful exploitation can expose limited confidential information, with no stated integrity or availability impact.

CVE-2026-73477: Quick Tabs - Moderately critical - Access bypass - SA-CONTRIB-2026-099

Affected Software

Remediation

Event History

Frequently Asked Questions

Which installations are affected?

What level of access does an attacker need?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

What level of access does an attacker need?