CVE-2026-73477: Quick Tabs - Moderately critical - Access bypass - SA-CONTRIB-2026-099
Published Sep 2, 2026
·Updated
Incorrect Authorization vulnerability in Drupal Quick Tabs allows Forceful Browsing. This issue affects Quick Tabs versions: from 0.0.0 to 4.3.1.
Affected Software
3 affected components
Quick Tabs>=0.0.0<=4.3.1
Quick Tabs Project Quick Tabs Drupal>=4.0.0<4.3.1
Quick Tabs Project Quick Tabs Drupal>=5.x-1.0<=8.x-3.0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/quick-tabsto a version that resolves this vulnerability.Fixed in 4.3.1Patch SA-CONTRIB-2026-099
Event History
Sep 2, 2026
CVE Published
via MITRE·12:32 PM
Data Sourced
via MITRE·12:32 PM
DescriptionWeakness
Data Sourced
via NVD·01:18 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
Which installations are affected?
Quick Tabs versions from 0.0.0 through 4.3.1 are affected. Installations using a version outside that range are not identified as affected by the provided information.
2
What level of access does an attacker need?
The vulnerability is remotely exploitable with low attack complexity and requires no privileges or user interaction. Successful exploitation can expose limited confidential information, with no stated integrity or availability impact.