{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3adrupalfasttoggle/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:drupal:fasttoggle:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-118569"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["fasttoggle (\u003c 4.1.1)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Drupal"],"content_html":"\u003cp\u003eThe Fasttoggle module for Drupal contains an authorization bypass vulnerability (CVE-2026-118569) where the module controller fails to verify entity access before modifying content state. Any user possessing the \u0026quot;use fasttoggle\u0026quot; permission can manipulate the publication status, promotion, or stickiness of any node or comment on the Drupal site. The flaw also functions as an information oracle for node existence because requesting a non-existent entity ID returns a 400 status code. The vulnerability does not provide remote code execution, SQL injection, or site-wide administrative access, but it enables the unauthorized publication of internal drafts and comments.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker authenticates as a low-privileged user possessing the \u0026quot;use fasttoggle\u0026quot; permission.\u003c/li\u003e\n\u003cli\u003eAttacker enumerates node IDs (nids) by sending requests to the \u003ccode\u003e/fasttoggle/node/{nid}/{action}\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eAttacker identifies targets based on response codes (400 for non-existent IDs, 200 for existing nodes).\u003c/li\u003e\n\u003cli\u003eAttacker performs targeted HTTP POST/GET requests to the vulnerable endpoint.\u003c/li\u003e\n\u003cli\u003eThe Fasttoggle controller loads the targeted entity without invoking \u003ccode\u003e$node-\u0026gt;access('update')\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe controller flips the flag (e.g., status, promote, sticky) and saves the entity.\u003c/li\u003e\n\u003cli\u003eThe target node or comment state is modified, making private drafts or comments publicly visible.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthorized users to publish internal drafts, approve their own comments, or manipulate the promotion and stickiness of content. These actions are not recorded in the Drupal revision history and lack logging within the 4.1.0 module version, preventing traditional audit trail identification.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the Fasttoggle module to version 4.1.1 or later to implement missing entity access checks and CSRF protections.\u003c/li\u003e\n\u003cli\u003eAudit existing \u0026quot;use fasttoggle\u0026quot; permissions for all user roles to restrict access to trusted editors only.\u003c/li\u003e\n\u003cli\u003eReview Drupal site content for unexpected status changes or visibility of drafts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-06T09:28:53Z","date_published":"2026-11-06T09:28:53Z","id":"https://feed.craftedsignal.io/briefs/2026-11-fasttoggle-auth-bypass/","summary":"The Fasttoggle module for Drupal contains an authorization bypass vulnerability (CVE-2026-118569) allowing authenticated users with the \"use fasttoggle\" permission to modify the publication status, promotion, or stickiness of arbitrary nodes and comments without appropriate access checks.","title":"Drupal Fasttoggle: Authorization bypass vulnerability (CVE-2026-118569)","url":"https://feed.craftedsignal.io/briefs/2026-11-fasttoggle-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:drupal:fasttoggle:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}