Authorization Flaw in Drupal IP Restriction Feature
CVE-2026-107255

Currently unrated

Key Information:

Vendor: Drupal
Status: Restrict Route By Ip
Vendor: CVE Published:; 30 October 2026

What is CVE-2026-107255?

A vulnerability exists in the Drupal module 'Restrict route by IP' where improper authorization mechanisms allow unauthorized users to access restricted areas. This flaw enables attackers to perform forceful browsing, potentially compromising sensitive data and functionalities. It affects specific versions of the module, making timely updates critical to mitigating exposure to this vulnerability.

Affected Version(s)

Restrict route by IP 0.0.0 < 1.3.1

Restrict route by IP 2.0.0 < 2.0.1

References

https://www.drupal.org/sa-contrib-2026-216

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Oct 30, 2026
Vulnerability Reserved
Oct 7, 2026

Credit

Elia Wehbe (ewehbe)

solideogloria

Swan Kalata (akalata)

Greg Knaddison (greggles)

Juraj Nemec (poker10)

CVE-2026-107255 Data

JSON