CVE-2026-118574 - Vulnerability Details - OpenCVE

Incorrect Permission Assignment for Critical Resource vulnerability in Drupal S3 File System allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects S3 File System versions: from 0.0.0 to 3.12.0.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Drupal	S3 File System

No data.

No data.

References

Link	Providers
https://www.drupal.org/sa-contrib-2026-279

History

Sat, 07 Nov 2026 07:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 06 Nov 2026 14:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 5.6, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L'}`

Fri, 30 Oct 2026 23:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Drupal Drupal s3 File System
Vendors & Products		Drupal Drupal s3 File System

Fri, 30 Oct 2026 03:30:00 +0000

Type	Values Removed	Values Added
Description		Incorrect Permission Assignment for Critical Resource vulnerability in Drupal S3 File System allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects S3 File System versions: from 0.0.0 to 3.12.0.
Title		S3 File System - Moderately critical - Access bypass - SA-CONTRIB-2026-279
Weaknesses		CWE-732
References		https://www.drupal.org/sa-contrib-2026-279

MITRE

Status: PUBLISHED

Assigner: drupal

Published: 2026-10-30T03:08:43.467Z

Updated: 2026-11-06T13:22:06.967Z

Reserved: 2026-10-28T15:50:46.720Z

Link: CVE-2026-118574

Vulnrichment

Updated: 2026-11-06T13:21:30.750Z

NVD

Status : Awaiting Analysis

Published: 2026-10-30T04:18:23.540

Modified: 2026-11-06T14:17:09.740

Link: CVE-2026-118574

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-118574", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "state": "PUBLISHED", "assignerShortName": "drupal", "dateReserved": "2026-10-28T15:50:46.720Z", "datePublished": "2026-10-30T03:08:43.467Z", "dateUpdated": "2026-11-06T13:22:06.967Z"}, "containers": {"cna": {"title": "S3 File System - Moderately critical - Access bypass - SA-CONTRIB-2026-279", "datePublic": "2026-10-28T17:33:39.000Z", "references": [{"url": "https://www.drupal.org/sa-contrib-2026-279"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-732", "description": "CWE-732 Incorrect Permission Assignment for Critical Resource", "lang": "en", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"}]}], "affected": [{"collectionURL": "https://www.drupal.org/project/s3fs", "product": "S3 File System", "vendor": "Drupal", "repo": "https://git.drupalcode.org/project/s3fs", "versions": [{"lessThan": "3.12.0", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "Incorrect Permission Assignment for Critical Resource vulnerability in Drupal S3 File System allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects S3 File System versions: from 0.0.0 to 3.12.0."}], "credits": [{"lang": "en", "type": "finder", "value": "Benjamin Wheeler (bennybobw)"}, {"lang": "en", "type": "finder", "value": "Justin Keiser (keiserjb)"}, {"lang": "en", "type": "remediation developer", "value": "Conrad Lara (cmlara)"}, {"lang": "en", "type": "remediation developer", "value": "Justin Keiser (keiserjb)"}, {"lang": "en", "type": "coordinator", "value": "Swan Kalata (akalata)"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison (greggles)"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec (poker10)"}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2026-10-30T03:08:43.467Z"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-11-06T13:22:01.569386Z", "id": "CVE-2026-118574", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T13:22:06.967Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-118574", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T13:22:01.569386Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T13:21:30.750Z"}}], "cna": {"title": "S3 File System - Moderately critical - Access bypass - SA-CONTRIB-2026-279", "credits": [{"lang": "en", "type": "finder", "value": "Benjamin Wheeler (bennybobw)"}, {"lang": "en", "type": "finder", "value": "Justin Keiser (keiserjb)"}, {"lang": "en", "type": "remediation developer", "value": "Conrad Lara (cmlara)"}, {"lang": "en", "type": "remediation developer", "value": "Justin Keiser (keiserjb)"}, {"lang": "en", "type": "coordinator", "value": "Swan Kalata (akalata)"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison (greggles)"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec (poker10)"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"}]}], "affected": [{"repo": "https://git.drupalcode.org/project/s3fs", "vendor": "Drupal", "product": "S3 File System", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "3.12.0", "versionType": "semver"}], "collectionURL": "https://www.drupal.org/project/s3fs"}], "datePublic": "2026-10-28T17:33:39.000Z", "references": [{"url": "https://www.drupal.org/sa-contrib-2026-279"}], "descriptions": [{"lang": "en", "value": "Incorrect Permission Assignment for Critical Resource vulnerability in Drupal S3 File System allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects S3 File System versions: from 0.0.0 to 3.12.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-732", "description": "CWE-732 Incorrect Permission Assignment for Critical Resource"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2026-10-30T03:08:43.467Z"}}}, "cveMetadata": {"cveId": "CVE-2026-118574", "state": "PUBLISHED", "dateUpdated": "2026-11-06T13:22:06.967Z", "dateReserved": "2026-10-28T15:50:46.720Z", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "datePublished": "2026-10-30T03:08:43.467Z", "assignerShortName": "drupal"}, "dataVersion": "5.2"}