CVE-2026-13239 Overview
CVE-2026-13239 is a Missing Authorization vulnerability [CWE-862] in the Drupal WissKI contributed module. The flaw allows Forceful Browsing, meaning unauthenticated attackers can access resources or functionality that should require authorization checks. All WissKI versions from 0.0.0 through 4.2.0 are affected.
The issue is network-exploitable with low attack complexity and requires no authentication or user interaction. Successful exploitation results in limited confidentiality and integrity impact against the affected Drupal site.
Critical Impact
Unauthenticated remote attackers can bypass authorization controls in the WissKI module to access restricted resources on affected Drupal installations.
Affected Products
- Drupal WissKI module versions 0.0.0 through 4.2.0
- Drupal installations with the WissKI contributed module enabled
- Sites relying on WissKI access control for restricted content
Discovery Timeline
- 2026-07-10 - CVE-2026-13239 published to the National Vulnerability Database (NVD)
- 2026-07-13 - Last updated in NVD database
Technical Details for CVE-2026-13239
Vulnerability Analysis
CVE-2026-13239 arises from missing authorization checks in the WissKI Drupal module. WissKI (Wissenschaftliche KommunikationsInfrastruktur) is a Drupal-based virtual research environment used for scholarly data curation. When authorization is not enforced on specific routes or resource handlers, an attacker can request URLs directly and receive content that should be gated by permission checks.
This pattern is known as Forceful Browsing. The application relies on obscurity or client-side controls rather than server-side permission validation. Because the module does not verify the requester's privileges before returning data, information intended for authorized users is exposed.
The vulnerability produces low confidentiality and low integrity impact. It does not affect availability. No user interaction and no privileges are required to trigger the flaw.
Root Cause
The root cause is a Missing Authorization weakness [CWE-862]. Handlers in WissKI up to version 4.2.0 do not consistently call Drupal's access control APIs before serving protected resources. Requests reach controller logic without a preceding permission check tied to the acting user's role.
Attack Vector
An unauthenticated attacker sends crafted HTTP requests to WissKI endpoints on the target Drupal site. By guessing or enumerating internal paths, the attacker reaches resources that the module should have restricted. No authentication, tokens, or social engineering are required. Public-facing Drupal sites running WissKI <= 4.2.0 are directly reachable over the network.
No verified public exploit code is available. See the Drupal Security Advisory for vendor-supplied technical details.
Detection Methods for CVE-2026-13239
Indicators of Compromise
- Unauthenticated HTTP requests to WissKI module paths returning 200 OK with restricted content
- Access logs showing enumeration patterns against WissKI routes from a single source IP
- Anonymous sessions retrieving WissKI resources that require role-based access
Detection Strategies
- Review Drupal watchdog and web server access logs for anonymous requests hitting WissKI endpoints
- Correlate HTTP 200 responses on WissKI URLs with sessions lacking authenticated cookies
- Deploy web application firewall rules that flag unauthenticated access to known WissKI administrative or data-export paths
Monitoring Recommendations
- Enable verbose logging on Drupal's access control subsystem for the WissKI module
- Alert on spikes in 404 and 403 responses that transition to 200 after path enumeration
- Track EPSS scoring (currently 0.159%, percentile 5.501) to reassess exploitation likelihood over time
How to Mitigate CVE-2026-13239
Immediate Actions Required
- Identify all Drupal sites running the WissKI module and inventory installed versions
- Upgrade WissKI to a version later than 4.2.0 as published in the vendor advisory
- Restrict network access to WissKI endpoints while patching is in progress
Patch Information
Refer to the Drupal Security Advisory SA-CONTRIB-2026-059 for the fixed release. Apply the update through Drupal's standard module upgrade process and clear caches after deployment. Confirm the installed version reports higher than 4.2.0 post-upgrade.
Workarounds
- Place authenticated reverse proxy or WAF rules in front of WissKI paths until patching completes
- Temporarily disable the WissKI module on sites that do not actively use it
- Enforce Drupal role-based permissions on WissKI content types and views as a compensating control
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
