Incorrect Authorization in Drupal Advanced Content Feedback Allows Forceful Browsing

Publication date: 2026-07-10

Last updated on: 2026-07-10

Assigner: Drupal.org

Description

Incorrect Authorization vulnerability in Drupal Advanced Content Feedback (aka admin_feedback) allows Forceful Browsing. This issue affects Advanced Content Feedback (aka admin_feedback) versions: from 0.0.0 to 2.8.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-10

Last Modified

2026-07-10

Generated

2026-07-11

AI Q&A

2026-07-11

EPSS Evaluated

N/A

NVD

CVE-2026-13232

EUVD

EUVD-2026-43056

Affected Vendors & Products

Vendor	Product	Version / Range
drupal	advanced_content_feedback	From 0.0.0 (inc) to 2.8.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability is an Incorrect Authorization issue in the Drupal Advanced Content Feedback module (also known as admin_feedback). It allows Forceful Browsing, meaning an attacker can access resources or pages they should not be authorized to view by manipulating URLs or requests.

Impact Analysis

The impact of this vulnerability is that unauthorized users may gain access to restricted content or administrative functions within the Drupal Advanced Content Feedback module. This can lead to exposure of sensitive information or unauthorized actions being performed.

Hi! I’m here to help you understand CVE-2026-13232. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70