CVE-2026-114553
Frontend Editing - Less critical - Access bypass - SA-CONTRIB-2026-241
Incorrect Authorization vulnerability in Drupal Frontend Editing allows Forceful Browsing. This issue affects Frontend Editing versions: from 0.0.0 to 1.9.3.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Frontend Editing - Less critical - Access bypass - SA-CONTRIB-2026-241
Incorrect Authorization vulnerability in Drupal Frontend Editing allows Forceful Browsing. This issue affects Frontend Editing versions: from 0.0.0 to 1.9.3.
- Record
CVE-2026-114553- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L - Weakness
- CWE-863
- Updated
- 2026-11-06
EUVDEUVD-2026-113531
Incorrect Authorization vulnerability in Drupal Frontend Editing allows Forceful Browsing. This issue affects Frontend Editing versions: from 0.0.0 to 1.9.3.
- Record
EUVD-2026-113531- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L - Updated
- 2026-11-06
GitHub AdvisoriesGHSA-62hx-4jm7-723g
Incorrect Authorization vulnerability in Drupal Frontend Editing allows Forceful Browsing. This...
Incorrect Authorization vulnerability in Drupal Frontend Editing allows Forceful Browsing. This issue affects Frontend Editing versions: from 0.0.0 to 1.9.3.
- Record
GHSA-62hx-4jm7-723g- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L - Weakness
- CWE-863
- Updated
- 2026-11-06
NVD
Incorrect Authorization vulnerability in Drupal Frontend Editing allows Forceful Browsing. This issue affects Frontend Editing versions: from 0.0.0 to 1.9.3.
- Record
CVE-2026-114553- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L - Weakness
- CWE-863
- Updated
- 2026-11-06
OSV
Frontend Editing - Less critical - Access bypass - SA-CONTRIB-2026-241
Incorrect Authorization vulnerability in Drupal Frontend Editing allows Forceful Browsing. This issue affects Frontend Editing versions: from 0.0.0 to 1.9.3.
- Record
CVE-2026-114553- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L - Weakness
- CWE-863
- Updated
- 2026-11-07
OSVDRUPAL-CONTRIB-2026-241 No score
This module enables editors to edit content, including paragraphs, directly on the rendered page.
The module doesn't sufficiently check field access permissions when editing, deleting or adding paragraph items to entity reference revisions fields.
This vulnerability is mitigated by the fact that an attacker must have a role with the permissions "access frontend editing", "add paragraphs"/"edit paragraphs"/"delete paragraphs" and also have access to update the parent entity the field belongs to.
- Record
DRUPAL-CONTRIB-2026-241- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/frontend_editingPackagist:https://packages.drupal.org/8 |
before 1.9.3 | 1.9.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts, severity | CVE List | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-114553 is a medium vulnerability (CVSS 5.4) in Drupal Frontend Editing, published October 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 11th percentile. Fixed in drupal/frontend_editing 1.9.3.