CVE-2026-11909

Critical · CVSS 9.8

drupal/examples — Missing Authorization (Forceful Browsing) CWE-862

CVSS: 9.8; nvd
EPSS: 0.14%; 4th pct
KEV: No
Class: oss containerizable; CWE-862

Description

Missing Authorization vulnerability in Drupal Examples for Developers allows Forceful Browsing. This issue affects Examples for Developers versions: from 0.0.0 to 4.0.6.

Search profile — drives PoC discovery

Symbols drupal/examplesExamples for Developerssa-contrib-2026-044packages.drupal.org/8Forceful BrowsingCWE-862

Keywords CVE-2026-11909Drupal Examples for DevelopersMissing AuthorizationForceful Browsingdrupal/examples PoCsa-contrib-2026-044Drupal CWE-862examples module Drupal exploitdrupal examples 4.0.6 vulnerability

Versions: 0.0.0 to 4.0.6

Affected packages

Packagist:https://packages.drupal.org/8

drupal/examples

0 → 4.0.6

References

https://www.drupal.org/sa-contrib-2026-044

Status: enriched · ingested 2026-07-13T18:00:21.000Z · profiled 2026-07-13T18:30:21.000Z