{"id":"CVE-2026-107309","aliases":["DRUPAL-CONTRIB-2026-212","EUVD-2026-113563","GHSA-8hqq-wrgf-qc4g"],"status":"published","title":"Easy Breadcrumb - Moderately critical - Information disclosure - SA-CONTRIB-2026-212","description":"Missing Authorization vulnerability in Drupal Easy Breadcrumb allows Forceful Browsing. This issue affects Easy Breadcrumb versions: from 0.0.0 to 2.0.11.","severity":{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00197,"percentile":0.0954,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-862"],"published":"2026-10-07T16:37:06Z","modified":"2026-11-01T02:30:47Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/easy_breadcrumb","fixed_in":["2.0.11"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/easy_breadcrumb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.11"}]}]}],"products":[{"vendor":"drupal","product":"easy breadcrumb"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2026-212","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107309","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-8hqq-wrgf-qc4g"},{"url":"https://git.drupalcode.org/project/easy_breadcrumb","tags":["web"]},{"url":"https://www.drupal.org/project/easy_breadcrumb","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107309.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-107309","title":"Easy Breadcrumb - Moderately critical - Information disclosure - SA-CONTRIB-2026-212","description":"Missing Authorization vulnerability in Drupal Easy Breadcrumb allows Forceful Browsing. This issue affects Easy Breadcrumb versions: from 0.0.0 to 2.0.11.","status":"published","published":"2026-10-30T03:10:02.716Z","modified":"2026-10-30T20:35:36.354Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"adp"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T13:45:14.072357Z"}],"euvd":[{"id":"EUVD-2026-113563","description":"Missing Authorization vulnerability in Drupal Easy Breadcrumb allows Forceful Browsing. This issue affects Easy Breadcrumb versions: from 0.0.0 to 2.0.11.","status":"published","published":"2026-10-30T03:10:02Z","modified":"2026-10-30T20:35:36Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T16:59:01.632804Z"}],"ghsa":[{"id":"GHSA-8hqq-wrgf-qc4g","title":"Missing Authorization vulnerability in Drupal Easy Breadcrumb allows Forceful Browsing. This...","description":"Missing Authorization vulnerability in Drupal Easy Breadcrumb allows Forceful Browsing. This issue affects Easy Breadcrumb versions: from 0.0.0 to 2.0.11.","status":"published","published":"2026-10-30T06:31:51Z","modified":"2026-10-30T21:32:29Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:14:52.597654Z"}],"nvd":[{"id":"CVE-2026-107309","description":"Missing Authorization vulnerability in Drupal Easy Breadcrumb allows Forceful Browsing. This issue affects Easy Breadcrumb versions: from 0.0.0 to 2.0.11.","status":"published","published":"2026-10-30T04:17:58.72Z","modified":"2026-10-30T21:16:50.18Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:13:04.940026Z"}],"osv":[{"id":"CVE-2026-107309","title":"Easy Breadcrumb - Moderately critical - Information disclosure - SA-CONTRIB-2026-212","description":"Missing Authorization vulnerability in Drupal Easy Breadcrumb allows Forceful Browsing. This issue affects Easy Breadcrumb versions: from 0.0.0 to 2.0.11.","status":"published","published":"2026-10-30T03:10:02.716Z","modified":"2026-11-01T02:30:47.478704807Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:44:54.933106Z"},{"id":"DRUPAL-CONTRIB-2026-212","description":"This module enables you to show a breadcrumb trail for taxonomy term hierarchies.\n\nThe module doesn't sufficiently check for view access of parent terms before rendering the crumb segment.\n\nThis vulnerability is mitigated by the fact that the setting \"Add parent hierarchy\" (term\\_hierarchy) must be enabled, and at least one term has a term in the parent hierarchy that is unpublished.","status":"published","published":"2026-10-07T16:37:06Z","modified":"2026-10-07T20:15:06.826582896Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}