CVE-2026-87943: SAML SSO - Service Provider - Critical - Improper access control - SA-CONTRIB-2026-141

Q: Which deployments are affected?

Drupal sites using the SAML SSO - Service Provider module are affected if they run a version from 0.0.0 through 3.2.0.

Q: What type of access does an attacker need?

The available information identifies forceful browsing caused by missing authorization, but does not specify whether authentication or any particular role is required.

Published Oct 22, 2026

Updated

Missing Authorization vulnerability in Drupal SAML SSO - Service Provider allows Forceful Browsing. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.

Affected Software

1 affected component

Drupal SAML SSO - Service Provider>=0.0.0<=3.2.0

Event History

Oct 22, 2026

CVE Published

via MITRE·01:21 AM

Data Sourced

via MITRE·01:21 AM

DescriptionWeakness

Frequently Asked Questions

Which deployments are affected?

Drupal sites using the SAML SSO - Service Provider module are affected if they run a version from 0.0.0 through 3.2.0.

What type of access does an attacker need?

The available information identifies forceful browsing caused by missing authorization, but does not specify whether authentication or any particular role is required.

CVE-2026-87943: SAML SSO - Service Provider - Critical - Improper access control - SA-CONTRIB-2026-141

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What type of access does an attacker need?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What type of access does an attacker need?