Incorrect Authorization Vulnerability in Drupal Gutenberg
CVE-2026-107263

Currently unrated

Key Information:

Vendor

Drupal
Status
Gutenberg
Vendor
CVE Published:
30 October 2026

What is CVE-2026-107263?

An incorrect authorization vulnerability in Drupal Gutenberg enables attackers to perform forceful browsing. This security issue affects a range of versions, specifically from 0.0.0 up to 2.15.0 and from 3.0.0 to 3.0.7, allowing unauthorized access to specific functionalities within the product. This can lead to potential misuse, exposing sensitive data and compromising the integrity of the affected systems, making it essential for users to assess their installations and apply necessary updates.

Affected Version(s)

Gutenberg 0.0.0 < 2.15.0

Gutenberg 3.0.0 < 3.0.7

References

https://www.drupal.org/sa-contrib-2026-202

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tommaso Gregori (p1s1o)
Drew Webber (mcdruid)
Stephan Zeidler (szeidler)
Swan Kalata (akalata)
Greg Knaddison (greggles)
Drew Webber (mcdruid)
Juraj Nemec (poker10)
.