CVE-2026-18259 describes an observable timing discrepancy vulnerability in the Drupal Token Content Access module. This flaw allows attackers to perform brute force attacks by exploiting timing differences in the module's responses. The affected versions include all releases from 0.0.0 up to 3.1.2. The vulnerability has a CVSS 3.1 base score of 7.5, reflecting a high severity with network attack vector, low complexity, no privileges required, and no user interaction needed. The impact is limited to confidentiality compromise without affecting integrity or availability.

Successful exploitation of this vulnerability can lead to unauthorized information disclosure due to timing discrepancies that facilitate brute force attacks. The attacker can gain access to sensitive information without requiring privileges or user interaction. There is no impact on data integrity or system availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided, users should monitor the Drupal Token Content Access module's official channels for updates. Until a fix is available, consider limiting exposure of the affected module or implementing compensating controls to reduce brute force attack risks.