Vulnerability-Lookup

CVE-2026-11915 (GCVE-0-2026-11915)

Vulnerability from cvelistv5 – Published: 2026-07-10 21:58 – Updated: 2026-07-10 21:58

Title

Brute force attack protection - Critical - Unsupported - SA-CONTRIB-2026-047

Summary

vulnerability in Drupal Brute force attack protection allows . This issue affects Brute force attack protection versions: *.*.

Severity

No CVSS data available.

Assigner

drupal

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-047

Impacted products

1 product

Vendor	Product	Version
Drupal	Brute force attack protection	Affected: . (semver)

Date Public

2026-06-10 17:10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/bfap_sb",
          "product": "Brute force attack protection",
          "repo": "https://git.drupalcode.org/project/bfap_sb",
          "vendor": "Drupal",
          "versions": [
            {
              "status": "affected",
              "version": "*.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-06-10T17:10:26.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "vulnerability in Drupal Brute force attack protection allows . This issue affects Brute force attack protection versions: *.*."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-10T21:58:18.624Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-047"
        }
      ],
      "title": "Brute force attack protection - Critical - Unsupported - SA-CONTRIB-2026-047"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-11915",
    "datePublished": "2026-07-10T21:58:18.624Z",
    "dateReserved": "2026-06-10T16:43:06.497Z",
    "dateUpdated": "2026-07-10T21:58:18.624Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-11915",
      "date": "2026-07-11",
      "epss": "0.00153",
      "percentile": "0.04852"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-11915\",\"sourceIdentifier\":\"mlhess@drupal.org\",\"published\":\"2026-07-10T23:16:46.933\",\"lastModified\":\"2026-07-10T23:16:46.933\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"vulnerability in Drupal Brute force attack protection allows . This issue affects Brute force attack protection versions: *.*.\"}],\"affected\":[{\"source\":\"mlhess@drupal.org\",\"affectedData\":[{\"vendor\":\"Drupal\",\"product\":\"Brute force attack protection\",\"collectionURL\":\"https://www.drupal.org/project/bfap_sb\",\"repo\":\"https://git.drupalcode.org/project/bfap_sb\",\"versions\":[{\"version\":\"*.*\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://www.drupal.org/sa-contrib-2026-047\",\"source\":\"mlhess@drupal.org\"}]}}"
  }
}

drupal-contrib-2026-047

Vulnerability from drupal

Published

2026-06-10 17:10

Modified

2026-06-10 17:10

Summary

Details

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...

References

URL

Type

https://www.drupal.org/sa-contrib-2026-047

WEB

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "affected_versions": "*"
      },
      "package": {
        "ecosystem": "Packagist:https://packages.drupal.org/8",
        "name": "drupal/bfap_sb"
      },
      "ranges": [
        {
          "database_specific": {
            "constraint": "*"
          },
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": []
    }
  ],
  "aliases": [
    "CVE-2026-11915"
  ],
  "credits": [],
  "details": "The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: [https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...](https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-maintainer-of-a-project-that-is-unsupported-for-security-reasons)",
  "id": "DRUPAL-CONTRIB-2026-047",
  "modified": "2026-06-10T17:10:26.000Z",
  "published": "2026-06-10T17:10:26.000Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-contrib-2026-047"
    }
  ],
  "schema_version": "1.7.0"
}

FKIE_CVE-2026-11915

Vulnerability from fkie_nvd - Published: 2026-07-10 23:16 - Updated: 2026-07-10 23:16

Severity

Summary

vulnerability in Drupal Brute force attack protection allows . This issue affects Brute force attack protection versions: *.*.

References

	URL	Tags
	mlhess@drupal.org	https://www.drupal.org/sa-contrib-2026-047

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://www.drupal.org/project/bfap_sb",
          "product": "Brute force attack protection",
          "repo": "https://git.drupalcode.org/project/bfap_sb",
          "vendor": "Drupal",
          "versions": [
            {
              "status": "affected",
              "version": "*.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "mlhess@drupal.org"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "vulnerability in Drupal Brute force attack protection allows . This issue affects Brute force attack protection versions: *.*."
    }
  ],
  "id": "CVE-2026-11915",
  "lastModified": "2026-07-10T23:16:46.933",
  "metrics": {},
  "published": "2026-07-10T23:16:46.933",
  "references": [
    {
      "source": "mlhess@drupal.org",
      "url": "https://www.drupal.org/sa-contrib-2026-047"
    }
  ],
  "sourceIdentifier": "mlhess@drupal.org",
  "vulnStatus": "Received"
}

GHSA-Q4VW-Q8JQ-2JG7

Vulnerability from github – Published: 2026-07-11 00:31 – Updated: 2026-07-11 00:31

Details

vulnerability in Drupal Brute force attack protection allows . This issue affects Brute force attack protection versions: ..

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-11915"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-10T23:16:46Z",
    "severity": null
  },
  "details": "vulnerability in Drupal Brute force attack protection allows . This issue affects Brute force attack protection versions: *.*.",
  "id": "GHSA-q4vw-q8jq-2jg7",
  "modified": "2026-07-11T00:31:49Z",
  "published": "2026-07-11T00:31:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11915"
    },
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-contrib-2026-047"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

WID-SEC-W-2026-1882

Vulnerability from csaf_certbund - Published: 2026-06-10 22:00 - Updated: 2026-06-10 22:00

Summary

Drupal: Mehrere Schwachstellen

Severity

Mittel

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Drupal ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Angriff: Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um einen Cross Site Scripting Angriff durchzuführen, Sicherheitsmaßnahmen zu umgehen und weitere, nicht spezifizierte Auswirkungen zu verursachen.

Betroffene Betriebssysteme: - Sonstiges - UNIX - Windows

CVE-2026-11908

Affected products

Known affected 5 products

Product	Identifier	Version
Open Source Drupal Mother May I Open Source / Drupal	`cpe:/a:drupal:drupal:mother_may_i`	Mother May I
Open Source Drupal Examples for Developers <4.0.6 Open Source / Drupal		Examples for Developers <4.0.6
Open Source Drupal Tagify <1.2.52 Open Source / Drupal		Tagify <1.2.52
Open Source Drupal Brute force attack protection Open Source / Drupal	`cpe:/a:drupal:drupal:brute_force_attack_protection`	Brute force attack protection
Open Source Drupal Composer Open Source / Drupal	`cpe:/a:drupal:drupal:composer`	Composer

CVE-2026-11909

Affected products

Known affected 5 products

Product	Identifier	Version
Open Source Drupal Mother May I Open Source / Drupal	`cpe:/a:drupal:drupal:mother_may_i`	Mother May I
Open Source Drupal Examples for Developers <4.0.6 Open Source / Drupal		Examples for Developers <4.0.6
Open Source Drupal Tagify <1.2.52 Open Source / Drupal		Tagify <1.2.52
Open Source Drupal Brute force attack protection Open Source / Drupal	`cpe:/a:drupal:drupal:brute_force_attack_protection`	Brute force attack protection
Open Source Drupal Composer Open Source / Drupal	`cpe:/a:drupal:drupal:composer`	Composer

CVE-2026-11913

Affected products

Known affected 5 products

Product	Identifier	Version
Open Source Drupal Mother May I Open Source / Drupal	`cpe:/a:drupal:drupal:mother_may_i`	Mother May I
Open Source Drupal Examples for Developers <4.0.6 Open Source / Drupal		Examples for Developers <4.0.6
Open Source Drupal Tagify <1.2.52 Open Source / Drupal		Tagify <1.2.52
Open Source Drupal Brute force attack protection Open Source / Drupal	`cpe:/a:drupal:drupal:brute_force_attack_protection`	Brute force attack protection
Open Source Drupal Composer Open Source / Drupal	`cpe:/a:drupal:drupal:composer`	Composer

CVE-2026-11914

Affected products

Known affected 5 products

Product	Identifier	Version
Open Source Drupal Mother May I Open Source / Drupal	`cpe:/a:drupal:drupal:mother_may_i`	Mother May I
Open Source Drupal Examples for Developers <4.0.6 Open Source / Drupal		Examples for Developers <4.0.6
Open Source Drupal Tagify <1.2.52 Open Source / Drupal		Tagify <1.2.52
Open Source Drupal Brute force attack protection Open Source / Drupal	`cpe:/a:drupal:drupal:brute_force_attack_protection`	Brute force attack protection
Open Source Drupal Composer Open Source / Drupal	`cpe:/a:drupal:drupal:composer`	Composer

CVE-2026-11915

Affected products

Known affected 5 products

Product	Identifier	Version
Open Source Drupal Mother May I Open Source / Drupal	`cpe:/a:drupal:drupal:mother_may_i`	Mother May I
Open Source Drupal Examples for Developers <4.0.6 Open Source / Drupal		Examples for Developers <4.0.6
Open Source Drupal Tagify <1.2.52 Open Source / Drupal		Tagify <1.2.52
Open Source Drupal Brute force attack protection Open Source / Drupal	`cpe:/a:drupal:drupal:brute_force_attack_protection`	Brute force attack protection
Open Source Drupal Composer Open Source / Drupal	`cpe:/a:drupal:drupal:composer`	Composer

References

7 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://www.drupal.org/sa-contrib-2026-043	external
https://www.drupal.org/sa-contrib-2026-044	external
https://www.drupal.org/sa-contrib-2026-045	external
https://www.drupal.org/sa-contrib-2026-046	external
https://www.drupal.org/sa-contrib-2026-047	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Drupal ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. \u00dcber zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um einen Cross Site Scripting Angriff durchzuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen und weitere, nicht spezifizierte Auswirkungen zu verursachen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-1882 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1882.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-1882 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1882"
      },
      {
        "category": "external",
        "summary": "Drupal Security Advisory sa-contrib-2026-043 vom 2026-06-10",
        "url": "https://www.drupal.org/sa-contrib-2026-043"
      },
      {
        "category": "external",
        "summary": "Drupal Security Advisory sa-contrib-2026-044 vom 2026-06-10",
        "url": "https://www.drupal.org/sa-contrib-2026-044"
      },
      {
        "category": "external",
        "summary": "Drupal Security Advisory sa-contrib-2026-045 vom 2026-06-10",
        "url": "https://www.drupal.org/sa-contrib-2026-045"
      },
      {
        "category": "external",
        "summary": "Drupal Security Advisory sa-contrib-2026-046 vom 2026-06-10",
        "url": "https://www.drupal.org/sa-contrib-2026-046"
      },
      {
        "category": "external",
        "summary": "Drupal Security Advisory sa-contrib-2026-047 vom 2026-06-10",
        "url": "https://www.drupal.org/sa-contrib-2026-047"
      }
    ],
    "source_lang": "en-US",
    "title": "Drupal: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-06-10T22:00:00.000+00:00",
      "generator": {
        "date": "2026-06-11T10:55:54.135+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-1882",
      "initial_release_date": "2026-06-10T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-06-10T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "Tagify \u003c1.2.52",
                "product": {
                  "name": "Open Source Drupal Tagify \u003c1.2.52",
                  "product_id": "T055254"
                }
              },
              {
                "category": "product_version",
                "name": "Tagify 1.2.52",
                "product": {
                  "name": "Open Source Drupal Tagify 1.2.52",
                  "product_id": "T055254-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:drupal:drupal:tagify__1.2.52"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Examples for Developers \u003c4.0.6",
                "product": {
                  "name": "Open Source Drupal Examples for Developers \u003c4.0.6",
                  "product_id": "T055255"
                }
              },
              {
                "category": "product_version",
                "name": "Examples for Developers 4.0.6",
                "product": {
                  "name": "Open Source Drupal Examples for Developers 4.0.6",
                  "product_id": "T055255-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:drupal:drupal:examples_for_developers__4.0.6"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "Mother May I",
                "product": {
                  "name": "Open Source Drupal Mother May I",
                  "product_id": "T055256",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:drupal:drupal:mother_may_i"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "Composer",
                "product": {
                  "name": "Open Source Drupal Composer",
                  "product_id": "T055257",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:drupal:drupal:composer"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "Brute force attack protection",
                "product": {
                  "name": "Open Source Drupal Brute force attack protection",
                  "product_id": "T055258",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:drupal:drupal:brute_force_attack_protection"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Drupal"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-11908",
      "product_status": {
        "known_affected": [
          "T055256",
          "T055255",
          "T055254",
          "T055258",
          "T055257"
        ]
      },
      "release_date": "2026-06-10T22:00:00.000+00:00",
      "title": "CVE-2026-11908"
    },
    {
      "cve": "CVE-2026-11909",
      "product_status": {
        "known_affected": [
          "T055256",
          "T055255",
          "T055254",
          "T055258",
          "T055257"
        ]
      },
      "release_date": "2026-06-10T22:00:00.000+00:00",
      "title": "CVE-2026-11909"
    },
    {
      "cve": "CVE-2026-11913",
      "product_status": {
        "known_affected": [
          "T055256",
          "T055255",
          "T055254",
          "T055258",
          "T055257"
        ]
      },
      "release_date": "2026-06-10T22:00:00.000+00:00",
      "title": "CVE-2026-11913"
    },
    {
      "cve": "CVE-2026-11914",
      "product_status": {
        "known_affected": [
          "T055256",
          "T055255",
          "T055254",
          "T055258",
          "T055257"
        ]
      },
      "release_date": "2026-06-10T22:00:00.000+00:00",
      "title": "CVE-2026-11914"
    },
    {
      "cve": "CVE-2026-11915",
      "product_status": {
        "known_affected": [
          "T055256",
          "T055255",
          "T055254",
          "T055258",
          "T055257"
        ]
      },
      "release_date": "2026-06-10T22:00:00.000+00:00",
      "title": "CVE-2026-11915"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-11915 (GCVE-0-2026-11915)

drupal-contrib-2026-047

Vulnerability from drupal

FKIE_CVE-2026-11915

GHSA-Q4VW-Q8JQ-2JG7

WID-SEC-W-2026-1882

Tags

Sightings

Nomenclature