Missing Authorization in Drupal SAML SSO - Service Provider
CVE-2026-87943

6.5MEDIUM

Key Information:

Vendor

Drupal
Status
Saml Sso - Service Provider
Vendor
CVE Published:
22 October 2026

What is CVE-2026-87943?

A Missing Authorization vulnerability in the Drupal SAML SSO - Service Provider allows unauthorized users to access restricted functionalities through forceful browsing. This security flaw can potentially expose sensitive information and compromise user privacy. Users are advised to upgrade to the latest software version to mitigate risks associated with this vulnerability.

Affected Version(s)

SAML SSO - Service Provider 0.0.0 < 3.2.0

References

https://www.drupal.org/sa-contrib-2026-141

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Brian Willows (hsjbrianwillows)
Roushan Kumar Singh (roushan59227)
Sudhanshu Dhage (sudhanshu0542)
Bram Driesen (bramdriesen)
Greg Knaddison (greggles)
Juraj Nemec (poker10)
Jess (xjm)
Swan Kalata (akalata)
.