CVE-2026-73477: CWE-863 Incorrect Authorization in Drupal Quick Tabs

This vulnerability (CVE-2026-73477) in Drupal Quick Tabs is classified as CWE-863 (Incorrect Authorization). It allows unauthorized users to perform forceful browsing, potentially accessing content or functionality they should not be able to reach. The affected versions include all releases from 0.0.0 through 4.3.1. The CVSS v3.1 base score is 5.3, indicating a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact. No vendor advisory or patch information is currently available, and no known exploits have been reported.

An attacker could bypass authorization controls to access restricted content or functionality within the Quick Tabs module. The impact is limited to confidentiality loss without affecting integrity or availability. Since no exploits are known in the wild, the risk is currently theoretical but should be addressed to prevent unauthorized access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor Drupal security channels for updates and consider restricting access to Quick Tabs functionality where possible to reduce exposure.