CVE-2026-11909

LowCVSS 3.3

Published: 10/07/2026(UTC)Updated: 06/08/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

6th percentile - higher than 6% of all known CVEs

Summary

The Examples for Developers module for Drupal has a missing authorization vulnerability, allowing forceful browsing and unauthorized access to resources. This affects versions from 0.0.0 to 4.0.6.

Risk Assessment

An attacker can access sensitive data or functions without proper permissions, leading to confidentiality and integrity breaches.

Recommendation

Immediately update the Examples for Developers module to version 4.0.7 or later, which includes a fix for the missing authorization.

Original NVD description (English source)

Missing Authorization vulnerability in Drupal Examples for Developers allows Forceful Browsing. This issue affects Examples for Developers versions: from 0.0.0 to 4.0.6.