CVE-2026-118569

Name of the Vulnerable Software and Affected Versions Drupal Fasttoggle versions 0.0.0 through 4.1.1

Description An incorrect authorization issue allows forceful browsing. The module fails to sufficiently verify access permissions for the entity being toggled when a user with the "Use Fasttoggle" permission submits a request to the toggle URL. This allows a user to change the publication status, promotion, or stickiness of any node or comment, regardless of whether they have the required permissions to update that specific entity, potentially enabling the publication of unpublished drafts they are not authorized to view.

Recommendations Update Drupal Fasttoggle to a version later than 4.1.1. Restrict the "Use Fasttoggle" permission to only highly trusted administrative users.