CVE-2026-15916

Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010

Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*, from 0.0.0 to 11.2.*.

We have discovered 175,993 live websites that are affected by CVE-2026-15916.

Run a Free Instant Scan



Affected Software

Product  Drupal
Category Content Management System
Vulnerable Domains175,993 live websites (87% of Drupal install base)
Vulnerable Versions
  • from 0 through 10.6.13
  • from 11.3 through 11.3.14
  • from 11.4 through 11.4.4
Vulnerable Versions Count306 versions ( 88% of all versions)


Common Weakness Enumeration

CWE-862 Missing Authorization



Details

  • Published - Aug 25, 2026
  • Updated - Aug 26, 2026

Credits

  • offensive-ai (finder)
  • Benji Fisher (benjifisher) (remediation developer)
  • Kim Pepper (kim.pepper) (remediation developer)
  • Mohit Aghera (mohit_aghera) (remediation developer)
  • Benji Fisher (benjifisher) (coordinator)
  • catch (catch) (coordinator)
  • Lee Rowlands (larowlan) (coordinator)
  • Juraj Nemec (poker10) (coordinator)
  • Jess (xjm) (coordinator)

Website Distribution by Country

Number of websites using CVE-2026-15916
United States54,285 websites


Germany16,416 websites
France13,339 websites
Russia11,555 websites
Belgium7,143 websites
GB6,288 websites
Italy5,474 websites
Netherlands5,035 websites
Spain4,733 websites
Canada4,472 websites

Website Distribution by TLD

Number of websites using CVE-2026-15916
.com45,325 websites
.org16,381 websites
.de10,226 websites
.ru9,284 websites
.edu7,239 websites
.fr7,037 websites
.be6,671 websites
.nl4,313 websites
.it4,154 websites
.net3,792 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-15916

Top websites that are affected by CVE-2026-15916. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
***.**.uk GB***
***.gov United States***
****.fr France***
***.gov United States***
***.gov United States*,***
********.***.gov United States*,***
***.gov United States*,***
******.com United States*,***
****.gov United States*,***
********.gov United States*,***
See full domain list

FAQ

CVE-2026-15916 is Missing Authorization in Drupal
A total of 175,993 websites have been identified as vulnerable to CVE-2026-15916, based on global website indexing conducted by WebTechSurvey.
The Drupal is affected by the CVE-2026-15916 vulnerability.
Drupal versions up to 11.4.4 are vulnerable to CVE-2026-15916.
CVE-2026-15916 is resolved in version 11.4.4 of Drupal.