CVE-2026-96386
Smart Content - Moderately critical - Access bypass - SA-CONTRIB-2026-190
Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing. This issue affects Smart Content versions: from 0.0.0 to 3.2.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Smart Content - Moderately critical - Access bypass - SA-CONTRIB-2026-190
Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing. This issue affects Smart Content versions: from 0.0.0 to 3.2.1.
- Record
CVE-2026-96386- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-862
- Updated
- 2026-11-03
EUVDEUVD-2026-107811
Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing. This issue affects Smart Content versions: from 0.0.0 to 3.2.1.
- Record
EUVD-2026-107811- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-66qr-r933-j98q
Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing. This issue...
Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing. This issue affects Smart Content versions: from 0.0.0 to 3.2.1.
- Record
GHSA-66qr-r933-j98q- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
NVD
Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing. This issue affects Smart Content versions: from 0.0.0 to 3.2.1.
- Record
CVE-2026-96386- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
OSV
Smart Content - Moderately critical - Access bypass - SA-CONTRIB-2026-190
Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing. This issue affects Smart Content versions: from 0.0.0 to 3.2.1.
- Record
CVE-2026-96386- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-862
- Updated
- 2026-11-04
OSVDRUPAL-CONTRIB-2026-190No score
This module enables you to personalize content for anonymous and authenticated users by showing different blocks to visitors based on client-side conditions.
The Smart Content Block submodule doesn't sufficiently check block access when it renders the blocks of a "Display Blocks" reaction through the module's AJAX endpoint.
This vulnerability is mitigated by the fact that a site must have placed a block whose access is restricted to certain users inside a Display Blocks reaction. Sites that only use Views blocks in reactions are not affected, because Views re-checks access when the view is executed.
- Record
DRUPAL-CONTRIB-2026-190- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/smart_contentPackagist:https://packages.drupal.org/8 | before 3.2.1 | 3.2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | CVE List, EUVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-96386 is a medium vulnerability (CVSS 6.5) in Drupal Smart Content, published September 23, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 12th percentile. Fixed in drupal/smart_content 3.2.1.