DRUPAL-CONTRIB-2026-216: Restrict route by IP - Critical - Access bypass - SA-CONTRIB-2026-216
Published Oct 30, 2026
·Updated
Incorrect Authorization vulnerability in Drupal Restrict route by IP allows Forceful Browsing. This issue affects Restrict route by IP versions: from 0.0.0 to 1.3.1, from 2.0.0 to 2.0.1.
Affected Software
1 affected component
Drupal Restrict route by IP>=0.0.0<=1.3.1, >=2.0.0<=2.0.1
Event History
Oct 30, 2026
CVE Published
via OSV·03:09 AM
Data Sourced
via OSV·03:09 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which releases are affected?
Affected releases are 0.0.0 through 1.3.1 and 2.0.0 through 2.0.1. The provided information does not identify a fixed release.
2
What access does an attacker need to exploit this issue?
The vulnerability is remotely exploitable with low attack complexity. It requires no privileges and no user interaction.
3
What is the likely impact of successful exploitation?
An attacker may bypass IP-based route restrictions through forceful browsing. The reported impact includes limited compromise of confidentiality, integrity, and availability.