# Drupal Digital Signage Framework lacks authorization checks, allowing forceful browsing

- Date: 2026-09-02
- Location: Global
- Type: Vulnerability
- Sector: Vendor
- CVE: CVE-2026-81166

NVD published a missing authorization flaw in the Drupal Digital Signage Framework. It allows forceful browsing.

## Sources

- [CVE-2026-81166](https://nvd.nist.gov/vuln/detail/CVE-2026-81166) (NIST NVD)
- [https://www.drupal.org/sa-contrib-2026-109](https://www.drupal.org/sa-contrib-2026-109)

Page: https://signagelist.org/incidents/2026-09-drupal-digital-signage-framework-lacks-authorization-checks/