Missing Authorization Vulnerability in Drupal DKAN
CVE-2026-107267

Currently unrated

Key Information:

Vendor

Drupal
Status
Dkan
Vendor
CVE Published:
30 October 2026

What is CVE-2026-107267?

A missing authorization vulnerability in Drupal DKAN allows unauthorized users to access restricted content through forceful browsing. This flaw is present in DKAN versions ranging from 0.0.0 to 4.1.5, potentially compromising user data and system integrity. Ensure to update to the latest version and implement appropriate access controls to safeguard against unauthorized access.

Affected Version(s)

DKAN 0.0.0 < 4.0.4

DKAN 4.1.0 < 4.1.5

References

https://www.drupal.org/sa-contrib-2026-208

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Rodel Duterte (rduterte)
Dan Feder (dafeder)
Rodel Duterte (rduterte)
Steve Wirt (swirt)
Swan Kalata (akalata)
Greg Knaddison (greggles)
Juraj Nemec (poker10)
.