CWE-862: Missing Authorization vulnerabilities

A missing authorization vulnerability in the Drupal AI module allows forceful browsing, potentially enabling unauthorized users with some privileges to access restricted resources. The issue affects Drupal AI versions from 0.0.0 to 1.3.13 and from 1.4.0 to 1.4.8. The vulnerability has a medium severity with a CVSS score of 4.6.

CVE-2026-84913 is a missing authorization vulnerability in the Drupal AI Translate module that allows forceful browsing. It affects versions from 0.0.0 up to but not including 1.3.2, and from 1.4.0 up to but not including 1.4.1. The issue has been fixed in versions 1.3.2 and 1.4.1. The vulnerability has a medium severity with a CVSS score of 4.6.

CVE-2026-84914 is a missing authorization vulnerability in the Drupal Calculate Working Days module that allows forceful browsing. It affects versions from 0.0.0 up to but not including 2.0.3. The issue could allow unauthorized users to access certain functionality without proper permissions. A fix is available in version 2.0.3.

CVE-2026-84916 is a missing authorization vulnerability in Drupal Islandora versions from 0.0.0 up to but not including 2.19.0. This flaw allows unauthorized users to perform forceful browsing, potentially accessing resources without proper permissions. The issue has a low severity rating and a CVSS score of 3.7. A fix is available in Islandora version 2.19.0.

CVE-2026-84921 is a missing authorization vulnerability in the Drupal Webform Submissions Delete module versions prior to 1.2.0. It allows unauthorized users to perform forceful browsing to delete webform submissions without proper permissions. The issue is fixed in version 1.2.0.

CVE-2026-87943 is a missing authorization vulnerability in the Drupal SAML SSO - Service Provider module that allows forceful browsing. It affects versions from 0.0.0 up to but not including 3.2.0. The vulnerability has a medium severity with a CVSS score of 6.5. A fix is available in version 3.2.0.

CVE-2026-87954 is a missing authorization vulnerability in the Drupal Taxonomy Term Glossary module that allows forceful browsing. It affects all versions from 0.0.0 up to but not including 4.6.0. The vulnerability has a medium severity with a CVSS score of 4.3. A fix is available in version 4.6.0.

CVE-2026-87955 is a missing authorization vulnerability in the Drupal Ultimate Table Field module that allows forceful browsing. It affects versions from 0.0.0 up to but not including 1.1.1, and from 2.0.0 up to but not including 2.0.1. The vulnerability has a medium severity with a CVSS score of 4.3. Fixed versions are 1.1.1 and 2.0.1.

CVE-2026-96391 is a missing authorization vulnerability in the Drupal Webform REST module that allows forceful browsing. It affects versions from 0.0.0 up to but not including 4.2.1. The vulnerability has a medium severity with a CVSS score of 4.3. A fix is available in version 4.2.1.

CVE-2026-96380 is a missing authorization vulnerability in the Drupal CSS Usage Analyzer module versions 1.0.0 through 1.0.1. This flaw allows unauthorized users to perform forceful browsing, potentially accessing restricted resources. The issue is fixed in version 1.0.2.

CVE-2026-96386 is a missing authorization vulnerability in the Drupal Smart Content module that allows unauthorized users to perform forceful browsing. It affects versions from 0.0.0 up to but not including 3.2.1. The vulnerability has a medium severity with a CVSS score of 6.5. A fix is available in version 3.2.1.

Jupyter Server versions from 2.0.0 up to but not including 2.6.0 have a missing authorization check vulnerability related to kernel execution when using GatewayClient.url. This flaw allows a restricted authenticated user to bypass the configured authorizer and execute code on the kernel, potentially exposing sensitive data and allowing modification or disruption of the kernel environment. The issue is fixed in version 2.6.0. However, in 2.6.0 and later, if a deployment manually registers the deprecated gateway handlers module, the authorization bypass remains possible.

CVE-2026-105937 is a missing authorization vulnerability in Apache Pulsar's shadow topic feature. It allows an authenticated user with tenant admin role in their own tenant to create or update shadow topics bound to source topics in other tenants without authorization on those source topics. This can lead to unauthorized reading of retained messages and unintended deletion of source topic ledger data. The issue affects Apache Pulsar versions from 3.0.0 before 4.0.14 and from 4.1.0 before 4.2.5. Fixed versions disable shadow topics by default and require superuser role for cross-tenant shadow topic binding.

Apache Pulsar contains a missing authorization vulnerability in its Pulsar Functions worker REST API. Specifically, the deprecated functions connectors endpoints allow any authenticated user to read the catalog of installed Pulsar IO connectors without requiring super-user access, even when authorization is enabled. This exposure is limited to metadata disclosure of connector type definitions and does not allow modification or management of connectors. The issue affects versions from 2.4.1 before 4.0.14 and from 4.1.0 before 4.2.5. Fixed versions require super-user access for these endpoints, aligning with the worker connectors endpoint's authorization checks.

Apache Pulsar versions from 2.0.0-rc1-incubating before 4.0.14 and from 4.1.0 before 4.2.5 have a missing authorization vulnerability in the Functions Worker REST API trigger endpoint. Authenticated users authorized to manage functions in a namespace can cause the Functions Worker to publish messages to input topics they are not authorized to produce to, potentially affecting data integrity. The issue is fixed in versions 4.0.14 and 4.2.5.

CVE-2026-105934 is a missing authorization vulnerability in Apache Pulsar's broker admin REST API truncate operation for partitioned topics. Authenticated users with lookup permission but without tenant admin rights can truncate partitioned topics, causing subscription cursors to move to the end and deleting inactive ledgers, potentially leading to message loss. The issue affects Apache Pulsar versions from 2.8.0 before 4.0.14 and from 4.1.0 before 4.2.5. Fixed versions are 4.0.14 and 4.2.5.

CVE-2026-105932 is a missing authorization vulnerability in Apache Pulsar's broker admin REST API for non-persistent topics. The API endpoints for managing topic-level entry filter policies on non-persistent topics do not properly enforce authorization checks, allowing authenticated users with produce or consume permissions—but without policy management rights—to read, modify, or remove these policies. This issue only affects deployments where entry filters are installed and topic-level overrides are enabled, both of which are disabled by default. The vulnerability affects Apache Pulsar versions from 3.3.0 before 4.0.14 and from 4.1.0 before 4.2.5. Fixed versions are 4.0.14 and 4.2.5.