CVE-2026-13239

Received Received - Intake

Missing Authorization in Drupal WissKI Allows Forceful Browsing

Publication date: 2026-07-10

Last updated on: 2026-07-10

Assigner: Drupal.org

Description

Missing Authorization vulnerability in Drupal WissKI allows Forceful Browsing. This issue affects WissKI versions: from 0.0.0 to 4.2.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-10

Last Modified

2026-07-10

Generated

2026-07-11

AI Q&A

2026-07-11

EPSS Evaluated

N/A

NVD

CVE-2026-13239

EUVD

EUVD-2026-43063

Affected Vendors & Products

Vendor	Product	Version / Range
mlhess	wisski	From 0.0.0 (inc) to 4.2.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability is a Missing Authorization issue in the Drupal WissKI module that allows Forceful Browsing. It means that unauthorized users can access resources or pages that should be restricted because the system does not properly check if the user has permission.

The affected versions of WissKI are from 0.0.0 up to 4.2.0.

Impact Analysis

This vulnerability can allow unauthorized users to access sensitive or restricted information by bypassing authorization controls. This can lead to data exposure, unauthorized data modification, or other security breaches depending on what resources are accessible through forceful browsing.

Hi! I’m here to help you understand CVE-2026-13239. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70