Brute Force Vulnerability in Drupal Token Content Access
CVE-2026-18259

7.5HIGH

Key Information:

Vendor

Drupal
Status
Token Content Access
Vendor
CVE Published:
25 August 2026

What is CVE-2026-18259?

The Token Content Access module for Drupal contains a vulnerability that allows attackers to leverage observable timing discrepancies to perform Brute Force attacks. This affects all versions from 0.0.0 to 3.1.2, potentially compromising the security of Drupal-based applications utilizing this module.

Affected Version(s)

Token Content Access 0.0.0 < 3.1.2

References

https://www.drupal.org/sa-contrib-2026-090

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Robin (robincs)
Kyrylo Loboda (lobodakyrylo)
Bram Driesen (bramdriesen)
cilefen (cilefen)
Greg Knaddison (greggles)
Juraj Nemec (poker10)
Swan Kalata (akalata)
.