DRUPAL-CONTRIB-2026-227: Dopup - Critical - Information disclosure - SA-CONTRIB-2026-227
Published Oct 30, 2026
·Updated
Incorrect Authorization vulnerability in Drupal Dopup allows Forceful Browsing. This issue affects Dopup versions: from 0.0.0 to 1.0.7.
Affected Software
1 affected component
Drupal Dopup>=0.0.0<=1.0.7
Event History
Oct 30, 2026
CVE Published
via OSV·03:09 AM
Data Sourced
via OSV·03:09 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
The vulnerability can be exploited remotely without authentication or user interaction. An attacker needs network access to the affected Drupal site.
2
Which installations are affected?
Drupal sites using the Dopup module in versions from 0.0.0 through 1.0.7 are affected. The provided information does not identify any configuration prerequisite.
3
What is the likely impact of successful exploitation?
Successful forceful browsing can disclose information that should be protected by authorization controls. The supplied severity vector indicates confidentiality impact only, with no stated integrity or availability impact.