DRUPAL-CONTRIB-2026-241: Frontend Editing - Less critical - Access bypass - SA-CONTRIB-2026-241

Q: Which deployments are affected?

Drupal sites using the Frontend Editing module in versions from 0.0.0 through 1.9.3 are affected.

Q: What access does an attacker need to exploit this issue?

The vulnerability requires low-level privileges. It is remotely reachable over the network and does not require user interaction.

Q: What is the likely security impact?

The issue can allow unauthorized modification of data and can affect availability. The provided severity vector indicates no confidentiality impact.

Published Oct 30, 2026

Updated

Incorrect Authorization vulnerability in Drupal Frontend Editing allows Forceful Browsing. This issue affects Frontend Editing versions: from 0.0.0 to 1.9.3.

Affected Software

1 affected component

Drupal Frontend Editing>=0.0.0<=1.9.3

Event History

Oct 30, 2026

CVE Published

via OSV·03:09 AM

Data Sourced

via OSV·03:09 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Drupal sites using the Frontend Editing module in versions from 0.0.0 through 1.9.3 are affected.

What access does an attacker need to exploit this issue?

The vulnerability requires low-level privileges. It is remotely reachable over the network and does not require user interaction.

What is the likely security impact?