CVE-2026-11909: Rfay Examples For Developers

Low severity, CVSS 3.3. EPSS: 0.2% chance of exploitation in the next 30 days.

Missing Authorization vulnerability in Drupal Examples for Developers allows Forceful Browsing. This issue affects Examples for Developers versions: from 0.0.0 to 4.0.6.

Affected products

• Rfay Examples For Developers: before 4.0.6 (fixed in 4.0.6)

Published 2026-07-10. Last modified 2026-08-06.