CVE-2026-15916

Name of the Vulnerable Software and Affected Versions Drupal core versions 0.0.0 through 10.6.13 Drupal core versions 11.3.0 through 11.3.14 Drupal core versions 11.4.0 through 11.4.4 Drupal core versions 0.0.0 through 11.0.x Drupal core versions 0.0.0 through 11.1.x Drupal core versions 0.0.0 through 11.2.x

Description A missing authorization issue in the Image module allows forceful browsing, leading to information disclosure. The module fails to sufficiently check access to image style derivatives when files are served via a file stream other than private://. This issue occurs when Drupal is configured to use a contributed file scheme to serve private derived images.

Recommendations Update versions 0.0.0 through 10.6.13 to a newer version. Update versions 11.3.0 through 11.3.14 to a newer version. Update versions 11.4.0 through 11.4.4 to a newer version. Update versions 0.0.0 through 11.0.x to a newer version. Update versions 0.0.0 through 11.1.x to a newer version. Update versions 0.0.0 through 11.2.x to a newer version.