CVE-2026-118569

Low risk· EPSS 3%

Published: 30/10/2026(UTC)Updated: 30/10/2026(UTC)Translated: 30/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.14%

3th percentile - higher than 3% of all known CVEs

Summary

The Fasttoggle module for Drupal contains an Incorrect Authorization vulnerability that allows Forceful Browsing of resources a user should not be able to access. The issue affects versions from 0.0.0 to 4.1.1.

Risk Assessment

A low-privileged user could access protected features or data by directly requesting URLs. This may compromise the confidentiality and integrity of the site configuration.

Recommendation

Update the Fasttoggle module to a version later than 4.1.1. Review access logs for unusual requests to protected paths.

Other vulnerabilities in Drupal Fasttoggle

CVE-2026-118570Low risk· EPSS 1%
The Fasttoggle module for Drupal contains a Cross-Site Request Forgery (CSRF) vulnerability that allows an attacker to force unwanted actions on behalf of a logged-in user. The issue affects versions from 0.0.0 to 4.1.1.

Original NVD description (English source)

Incorrect Authorization vulnerability in Drupal Fasttoggle allows Forceful Browsing. This issue affects Fasttoggle versions: from 0.0.0 to 4.1.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS