CVE-2026-96386

Name of the Vulnerable Software and Affected Versions Drupal Smart Content versions 0.0.0 through 3.2.1

Description Missing authorization in the Smart Content Block submodule allows forceful browsing. The issue occurs when the module renders blocks of a "Display Blocks" reaction via the AJAX endpoint, as it fails to sufficiently verify block access. This affects sites that have placed blocks with restricted user access inside a Display Blocks reaction. Sites utilizing only Views blocks in reactions are not impacted because Views performs its own access re-verification during execution.

Recommendations Update Drupal Smart Content to a version later than 3.2.1. As a temporary mitigation, avoid placing blocks with restricted access inside Display Blocks reactions.