CVE-2026-107255
Restrict route by IP - Critical - Access bypass - SA-CONTRIB-2026-216
Incorrect Authorization vulnerability in Drupal Restrict route by IP allows Forceful Browsing. This issue affects Restrict route by IP versions: from 0.0.0 to 1.3.1, from 2.0.0 to 2.0.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Restrict route by IP - Critical - Access bypass - SA-CONTRIB-2026-216
Incorrect Authorization vulnerability in Drupal Restrict route by IP allows Forceful Browsing. This issue affects Restrict route by IP versions: from 0.0.0 to 1.3.1, from 2.0.0 to 2.0.1.
- Record
CVE-2026-107255- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-863
- Updated
- 2026-11-06
EUVDEUVD-2026-113559
Incorrect Authorization vulnerability in Drupal Restrict route by IP allows Forceful Browsing. This issue affects Restrict route by IP versions: from 0.0.0 to 1.3.1, from 2.0.0 to 2.0.1.
- Record
EUVD-2026-113559- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-06
GitHub AdvisoriesGHSA-5rgq-vm4r-fj73
Incorrect Authorization vulnerability in Drupal Restrict route by IP allows Forceful Browsing....
Incorrect Authorization vulnerability in Drupal Restrict route by IP allows Forceful Browsing. This issue affects Restrict route by IP versions: from 0.0.0 to 1.3.1, from 2.0.0 to 2.0.1.
- Record
GHSA-5rgq-vm4r-fj73- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-863
- Updated
- 2026-11-06
NVD
Incorrect Authorization vulnerability in Drupal Restrict route by IP allows Forceful Browsing. This issue affects Restrict route by IP versions: from 0.0.0 to 1.3.1, from 2.0.0 to 2.0.1.
- Record
CVE-2026-107255- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-863
- Updated
- 2026-11-06
OSV
Restrict route by IP - Critical - Access bypass - SA-CONTRIB-2026-216
Incorrect Authorization vulnerability in Drupal Restrict route by IP allows Forceful Browsing. This issue affects Restrict route by IP versions: from 0.0.0 to 1.3.1, from 2.0.0 to 2.0.1.
- Record
CVE-2026-107255- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-863
- Updated
- 2026-11-07
OSVDRUPAL-CONTRIB-2026-216 No score
This module enables you to restrict access to routes by IP address.
The module doesn't reliably restrict a subset of dynamic routes, leading to an access bypass vulnerability. The impact depends on how a site uses this module and whether it has any routes that are dynamic.
- Record
DRUPAL-CONTRIB-2026-216- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/restrict_route_by_ipPackagist:https://packages.drupal.org/8 |
before 1.3.1, 2.0.0 up to 2.0.1 | 1.3.12.0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| severity | CVE List | |
| facts, severity | EUVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-107255 is a high vulnerability (CVSS 7.3) in Drupal Restrict Route By Ip, published October 7, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 12th percentile. Fixed in drupal/restrict_route_by_ip 1.3.1.