CVE-2026-114543
Simple User Management - Moderately critical - Access bypass - SA-CONTRIB-2026-239
Incorrect Authorization vulnerability in Drupal Simple User Management allows Forceful Browsing. This issue affects Simple User Management versions: from 0.0.0 to 1.11.0.
Exploit likelihood
What each source reports
CVE List No score
Simple User Management - Moderately critical - Access bypass - SA-CONTRIB-2026-239
Incorrect Authorization vulnerability in Drupal Simple User Management allows Forceful Browsing. This issue affects Simple User Management versions: from 0.0.0 to 1.11.0.
- Record
CVE-2026-114543- Weakness
- CWE-863
- Updated
- 2026-11-02
EUVDEUVD-2026-113533 No score
Incorrect Authorization vulnerability in Drupal Simple User Management allows Forceful Browsing. This issue affects Simple User Management versions: from 0.0.0 to 1.11.0.
- Record
EUVD-2026-113533- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-c6fg-w63m-mwwv No score
Incorrect Authorization vulnerability in Drupal Simple User Management allows Forceful Browsing....
Incorrect Authorization vulnerability in Drupal Simple User Management allows Forceful Browsing. This issue affects Simple User Management versions: from 0.0.0 to 1.11.0.
- Record
GHSA-c6fg-w63m-mwwv- Weakness
- CWE-863
- Updated
- 2026-11-02
NVD No score
Incorrect Authorization vulnerability in Drupal Simple User Management allows Forceful Browsing. This issue affects Simple User Management versions: from 0.0.0 to 1.11.0.
- Record
CVE-2026-114543- Weakness
- CWE-863
- Updated
- 2026-11-02
OSVDRUPAL-CONTRIB-2026-239 No score
This module lets non-administrators approve, deactivate and delete users, limited by the roles they can delegate through Role Delegation.
The module doesn't sufficiently check role delegation when approving users, and offers an Activate link for blocked administrators. It also doesn't protect user 1 from being deactivated or deleted.
This vulnerability is mitigated by the fact that an attacker must have a role with one of the module's additional action permissions.
- Record
DRUPAL-CONTRIB-2026-239- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/simple_user_managementPackagist:https://packages.drupal.org/8 |
before 1.11.0 | 1.11.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-114543 is a vulnerability with no CVSS score yet in Drupal Simple User Management, published October 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.14%, the 3rd percentile. Fixed in drupal/simple_user_management 1.11.0.