Drupal Fasttoggle: Authorization bypass vulnerability (CVE-2026-118569)

The Fasttoggle module for Drupal contains an authorization bypass vulnerability (CVE-2026-118569) where the module controller fails to verify entity access before modifying content state. Any user possessing the "use fasttoggle" permission can manipulate the publication status, promotion, or stickiness of any node or comment on the Drupal site. The flaw also functions as an information oracle for node existence because requesting a non-existent entity ID returns a 400 status code. The vulnerability does not provide remote code execution, SQL injection, or site-wide administrative access, but it enables the unauthorized publication of internal drafts and comments.

Attack Chain

1. Attacker authenticates as a low-privileged user possessing the "use fasttoggle" permission.
2. Attacker enumerates node IDs (nids) by sending requests to the /fasttoggle/node/{nid}/{action} endpoint.
3. Attacker identifies targets based on response codes (400 for non-existent IDs, 200 for existing nodes).
4. Attacker performs targeted HTTP POST/GET requests to the vulnerable endpoint.
5. The Fasttoggle controller loads the targeted entity without invoking $node->access('update').
6. The controller flips the flag (e.g., status, promote, sticky) and saves the entity.
7. The target node or comment state is modified, making private drafts or comments publicly visible.

Impact

Successful exploitation allows unauthorized users to publish internal drafts, approve their own comments, or manipulate the promotion and stickiness of content. These actions are not recorded in the Drupal revision history and lack logging within the 4.1.0 module version, preventing traditional audit trail identification.

Recommendation

• Upgrade the Fasttoggle module to version 4.1.1 or later to implement missing entity access checks and CSRF protections.
• Audit existing "use fasttoggle" permissions for all user roles to restrict access to trusted editors only.
• Review Drupal site content for unexpected status changes or visibility of drafts.