Missing Authorization in Drupal SAML SSO - Service Provider
CVE-2026-87943

Currently unrated

Key Information:

Vendor

Drupal
Status
Saml Sso - Service Provider
Vendor
CVE Published:
22 October 2026

What is CVE-2026-87943?

A Missing Authorization vulnerability in the Drupal SAML SSO - Service Provider allows unauthorized users to access restricted functionalities through forceful browsing. This security flaw can potentially expose sensitive information and compromise user privacy. Users are advised to upgrade to the latest software version to mitigate risks associated with this vulnerability.

Affected Version(s)

SAML SSO - Service Provider 0.0.0 < 3.2.0

References

https://www.drupal.org/sa-contrib-2026-141

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Brian Willows (hsjbrianwillows)
Roushan Kumar Singh (roushan59227)
Sudhanshu Dhage (sudhanshu0542)
Bram Driesen (bramdriesen)
Greg Knaddison (greggles)
Juraj Nemec (poker10)
Jess (xjm)
Swan Kalata (akalata)
.