Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-1553: Drupal Canvas lets unauthorized users view restricted pages

CVE-2026-1553 · published 9 months ago

Summary

The Drupal Canvas add‑on for Drupal sites allows anyone to navigate to pages that should be protected. This could expose private data or let attackers change settings. Upgrade the Canvas module to version 1.0.4 or newer, or remove it if you cannot apply the update.

What to do

Update drupal_canvas_project drupal_canvas to version 1.0.4 or later.

Affected software

Vendor	Product	Affected versions
drupal_canvas_project	drupal_canvas	< 1.0.4 `cpe:2.3:a:drupal_canvas_project:drupal_canvas::::::drupal::*`

Original advisory text

Drupal Canvas - Moderately critical - Access bypass - SA-CONTRIB-2026-006

Incorrect Authorization vulnerability in Drupal Drupal Canvas allows Forceful Browsing.This issue affects Drupal Canvas: from 0.0.0 before 1.0.4.

References

https://git.drupalcode.org/project/canvas URL
https://www.drupal.org/project/canvas URL
https://www.drupal.org/sa-contrib-2026-006 URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1553.j... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-1553 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

4.8 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-863Incorrect Authorization

Timeline

Published4 Feb 2026

Updated31 Oct 2026

First seen6 Mar 2026

Sources

CVE-2026-1553 · NVD

CVE-2026-1553 · OSV

Track software like this

Free during beta