CVE-2026-114571

Name of the Vulnerable Software and Affected Versions Drupal Rabbit Hole versions 0.0.0 through 1.3.0

Description Incorrect authorization allows forceful browsing. The module enables site builders to control entity page views by showing the page, returning access denied or not found responses, or redirecting visitors. One issue allows anonymous visitors to bypass these behaviors using a specific query parameter, potentially viewing content intended to be hidden or avoiding redirects. Additionally, per-entity settings are stored in fields that lack proper access control; while the module checks permissions to display settings on the edit form, the fields themselves follow default access. This allows users with entity edit permissions to modify these settings if a write path that bypasses the entity form is available, such as REST, JSON:API with writes enabled, or Views Bulk Operations.

Recommendations Update Drupal Rabbit Hole to a version later than 1.3.0. Restrict write access to JSON:API, REST, or Views Bulk Operations for users who should not be modifying entity settings.