PT-2026-120916

CVE-2026-114543

Published

2026-10-21

Updated

2026-10-30

Description by

Score

N/A

Not available

No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.

Name of the Vulnerable Software and Affected Versions Drupal Simple User Management versions 0.0.0 through 1.11.0

Description An incorrect authorization issue allows forceful browsing. The module fails to sufficiently verify role delegation during the user approval process and provides an Activate link for blocked administrators. Additionally, it does not prevent the deactivation or deletion of user 1. Exploitation requires the attacker to possess a role with one of the module's additional action permissions.

Recommendations Update Drupal Simple User Management to a version later than 1.11.0.

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-863: Incorrect Authorization

Related identifiers