Auth bypass in Drupal Canvas

CVE-2026-1553

Incorrect Authorization vulnerability in Drupal Drupal Canvas allows Forceful Browsing.This issue affects Drupal Canvas: from 0.0.0 before 1.0.4.

Vulnerability class: Broken Access Control

EPSS: 0.000 (13.1th percentile) — read the EPSS interpretation.