Rabbit Hole lets site builders control what happens when an entity's page is viewed: show it, return an access denied or not found response, or… (CVE-2026-114571)

Rabbit Hole is a Drupal module that controls entity page access behavior. The first vulnerability permits bypassing Rabbit Hole restrictions by using a specific query parameter, causing the module to treat the request as an error page and effectively show content that should be hidden or denied, affecting anonymous visitors. The second vulnerability arises because per-entity Rabbit Hole settings fields lack dedicated access control and rely on Drupal's default field access, allowing users with permission to edit entities to modify Rabbit Hole settings if they can write via alternative methods such as JSON:API, REST, or Views Bulk Operations. Both vulnerabilities affect all sites using Rabbit Hole to restrict entity access and are present in versions before 1.3.0.

Anonymous users can bypass Rabbit Hole restrictions to view content that should be denied or hidden, potentially exposing sensitive or restricted information. Additionally, users with entity edit permissions and access to alternate write paths can modify Rabbit Hole settings, potentially altering access controls and redirect behaviors. These impacts compromise the intended access restrictions implemented by the module.

A patch is available for Rabbit Hole version 1.3.0 and later that addresses these vulnerabilities. Site administrators should upgrade to version 1.3.0 or newer. Until patched, restrict permissions to edit entities and disable or secure alternate write paths such as JSON:API writes, REST, or Views Bulk Operations to prevent unauthorized modification of Rabbit Hole settings.