Incorrect Authorization in Drupal Canvas Allows Unauthorized Access
CVE-2026-1553

4.8MEDIUM

Key Information:

Vendor

Drupal
Status
Drupal Canvas
Vendor
CVE Published:
4 February 2026

What is CVE-2026-1553?

An incorrect authorization vulnerability in Drupal Canvas allows unauthorized users to execute forceful browsing attacks. This issue compromises the intended access controls, potentially exposing sensitive user data and application functionalities. Users of Drupal Canvas versions prior to 1.0.4 are at risk and should take immediate action to secure their applications.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Drupal Canvas 0.0.0 < 1.0.4

References

https://www.drupal.org/sa-contrib-2026-006

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

jschref
Bålint KlÊri (balintbrews)
Matt Glaman (mglaman)
Christian López Espínola (penyaskito)
Tim Plunkett (tim.plunkett)
Alex Bronstein (effulgentsia)
Greg Knaddison (greggles)
JSON
.