CVE-2026-118574
Received Received - Intake

Incorrect Permission Assignment in Drupal S3 File System

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: Drupal.org

Description
Incorrect Permission Assignment for Critical Resource vulnerability in Drupal S3 File System allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects S3 File System versions: from 0.0.0 to 3.12.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-118574
EUVD
EUVD-2026-113692

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Drupal S3 File System 0.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-732 The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves incorrect permission assignments in the Drupal S3 File System. It allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized access or manipulation of critical resources.

Impact Analysis

If exploited, this vulnerability could allow attackers to gain unauthorized access to sensitive data stored via the S3 File System. This may result in data breaches, data loss, or unauthorized modifications to critical files.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, or other regulations by exposing sensitive data to unauthorized parties. Organizations may face legal penalties, reputational damage, and loss of trust due to data breaches.

Mitigation Strategies

Update S3 File System to version 3.12.0 or later to address the incorrect permission assignment issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-118574. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart