{"id":"CVE-2026-118573","aliases":["DRUPAL-CONTRIB-2026-290","EUVD-2026-113684","GHSA-72vv-q34x-gffg"],"status":"published","title":"OAuth2 Token Manager - Critical - Access bypass - SA-CONTRIB-2026-290","description":"Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forceful Browsing. This issue affects OAuth2 Token Manager versions: from 0.0.0 to 1.2.0.","severity":{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00144,"percentile":0.03759,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-862"],"published":"2026-10-28T17:42:05Z","modified":"2026-11-06T12:10:55Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/oauth2_token_manager","fixed_in":["1.2.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/oauth2_token_manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0"}]}]}],"products":[{"vendor":"drupal","product":"oauth2 token manager"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2026-290","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118573"},{"url":"https://github.com/advisories/GHSA-72vv-q34x-gffg"}],"sources":{"cve":[{"id":"CVE-2026-118573","title":"OAuth2 Token Manager - Critical - Access bypass - SA-CONTRIB-2026-290","description":"Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forceful Browsing. This issue affects OAuth2 Token Manager versions: from 0.0.0 to 1.2.0.","status":"published","published":"2026-10-30T03:08:35.264Z","modified":"2026-11-06T12:10:55.527Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-862"],"updated_at":"2026-11-06T13:28:12.24582Z"}],"euvd":[{"id":"EUVD-2026-113684","description":"Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forceful Browsing. This issue affects OAuth2 Token Manager versions: from 0.0.0 to 1.2.0.","status":"published","published":"2026-10-30T03:08:35Z","modified":"2026-11-06T12:10:55Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-06T13:04:55.758116Z"}],"ghsa":[{"id":"GHSA-72vv-q34x-gffg","title":"Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forceful Browsing. This...","description":"Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forceful Browsing. This issue affects OAuth2 Token Manager versions: from 0.0.0 to 1.2.0.","status":"published","published":"2026-10-30T06:32:01Z","modified":"2026-11-06T15:32:22Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-06T16:00:41.773289Z"}],"nvd":[{"id":"CVE-2026-118573","description":"Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forceful Browsing. This issue affects OAuth2 Token Manager versions: from 0.0.0 to 1.2.0.","status":"published","published":"2026-10-30T04:18:23.393Z","modified":"2026-11-06T13:17:29.073Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-06T16:00:35.469074Z"}],"osv":[{"id":"DRUPAL-CONTRIB-2026-290","description":"This module lets you manage system-wide OAuth2 access and refresh tokens for Box, Quip, and Slack integrations through Drush and an OAuth2 validation callback.\n\nThe module doesn't restrict access to its OAuth2 routes, allowing an an anonymous visitor to potentially connect the site's integration to an account they control.\n\nThis vulnerability is mitigated by the fact that an attacker must obtain the OAuth2 state value from a previous system token initialization (for example, from the server access logs).","status":"published","published":"2026-10-28T17:42:05Z","modified":"2026-10-28T18:15:05.882753298Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}