← Vulnerability Intelligence

CVE-2026-107255

Not yet rated

Not yet rated — under the NVD policy in effect since April 2026, most CVEs are no longer analyzed immediately. The EPSS score (if available) is still shown.

Description

Incorrect Authorization vulnerability in Drupal Restrict route by IP allows Forceful Browsing. This issue affects Restrict route by IP versions: from 0.0.0 to 1.3.1, from 2.0.0 to 2.0.1.

Metrics

EPSS — exploit probability
0% (percentile: 4) as of 1 November 2026
CWE
CWE-863

References