Missing Authorization vulnerability in Drupal Advanced Search allows Forceful Browsing. (CVE-2026-84910)

CVE-2026-84910 describes a missing authorization vulnerability in the Drupal Advanced Search module that permits forceful browsing. This means unauthorized users may access resources or functionality that should be restricted. The vulnerability affects all versions from 0.0.0 through 2.4.5. The CVSS 3.1 vector indicates the attack requires network access, high attack complexity, no privileges, and user interaction, resulting in limited confidentiality and integrity impacts but no availability impact.

The vulnerability allows unauthorized users to browse resources or perform actions that should be restricted, potentially exposing sensitive information or functionality. The impact is limited to confidentiality and integrity with no availability impact. The medium severity score reflects the moderate risk posed by this issue.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is currently available. Until a patch is released, restrict access to the affected module where possible and monitor for unusual access patterns related to forceful browsing attempts.