PT-2026-84886

CVE-2026-84910

Published

2026-09-02

Updated

2026-10-22

Description by

CVSS 3.1

4.2

Medium

MetricsAV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Drupal Advanced Search versions 0.0.0 through 2.4.5

Description A missing authorization issue allows forceful browsing. The module fails to sufficiently verify block access when arbitrary block IDs are submitted to its publicly accessible AJAX endpoint. This allows an unauthenticated attacker to retrieve restricted block content, provided they can identify the machine ID of a block containing sensitive information protected by visibility restrictions.

Recommendations Update Drupal Advanced Search to a version later than 2.4.5.

Exploitability

Exploit

Fix

Impacts

Researchers