OpenCVE

Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Login Disable allows Brute Force. This issue affects Login Disable versions: from 0.0.0 to 2.1.4.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Drupal	Login Disable

No data.

No data.

References

Link	Providers
https://www.drupal.org/sa-contrib-2026-070

History

Mon, 13 Jul 2026 18:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sat, 11 Jul 2026 01:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Drupal Drupal login Disable
Vendors & Products		Drupal Drupal login Disable

Fri, 10 Jul 2026 22:00:00 +0000

Type	Values Removed	Values Added
Description		Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Login Disable allows Brute Force. This issue affects Login Disable versions: from 0.0.0 to 2.1.4.
Title		Login Disable - Moderately critical - Access bypass - SA-CONTRIB-2026-070
Weaknesses		CWE-307
References		https://www.drupal.org/sa-contrib-2026-070

MITRE

Status: PUBLISHED

Assigner: drupal

Published: 2026-07-10T21:46:19.486Z

Updated: 2026-07-13T17:50:54.026Z

Reserved: 2026-07-08T15:44:53.333Z

Link: CVE-2026-15079

Vulnrichment

Updated: 2026-07-13T17:40:25.523Z

NVD

No data.

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-15079", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "state": "PUBLISHED", "assignerShortName": "drupal", "dateReserved": "2026-07-08T15:44:53.333Z", "datePublished": "2026-07-10T21:46:19.486Z", "dateUpdated": "2026-07-13T17:50:54.026Z"}, "containers": {"cna": {"title": "Login Disable - Moderately critical - Access bypass - SA-CONTRIB-2026-070", "datePublic": "2026-07-08T17:12:32.000Z", "references": [{"url": "https://www.drupal.org/sa-contrib-2026-070"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-307", "description": "CWE-307 Improper Restriction of Excessive Authentication Attempts", "lang": "en", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-112", "descriptions": [{"lang": "en", "value": "CAPEC-112 Brute Force"}]}], "affected": [{"collectionURL": "https://www.drupal.org/project/login_disable", "product": "Login Disable", "vendor": "Drupal", "repo": "https://git.drupalcode.org/project/login_disable", "versions": [{"lessThan": "2.1.4", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Login Disable allows Brute Force. This issue affects Login Disable versions: from 0.0.0 to 2.1.4."}], "credits": [{"lang": "en", "type": "finder", "value": "Pierre Rudloff (prudloff)"}, {"lang": "en", "type": "remediation developer", "value": "Boris Doesborg (batigolix)"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison (greggles)"}, {"lang": "en", "type": "coordinator", "value": "Pierre Rudloff (prudloff)"}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2026-07-10T21:46:19.486Z"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-07-13T17:50:36.737920Z", "id": "CVE-2026-15079", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-13T17:50:54.026Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-15079", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-13T17:50:36.737920Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-13T17:40:25.523Z"}}], "cna": {"title": "Login Disable - Moderately critical - Access bypass - SA-CONTRIB-2026-070", "credits": [{"lang": "en", "type": "finder", "value": "Pierre Rudloff (prudloff)"}, {"lang": "en", "type": "remediation developer", "value": "Boris Doesborg (batigolix)"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison (greggles)"}, {"lang": "en", "type": "coordinator", "value": "Pierre Rudloff (prudloff)"}], "impacts": [{"capecId": "CAPEC-112", "descriptions": [{"lang": "en", "value": "CAPEC-112 Brute Force"}]}], "affected": [{"repo": "https://git.drupalcode.org/project/login_disable", "vendor": "Drupal", "product": "Login Disable", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "2.1.4", "versionType": "semver"}], "collectionURL": "https://www.drupal.org/project/login_disable"}], "datePublic": "2026-07-08T17:12:32.000Z", "references": [{"url": "https://www.drupal.org/sa-contrib-2026-070"}], "descriptions": [{"lang": "en", "value": "Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Login Disable allows Brute Force. This issue affects Login Disable versions: from 0.0.0 to 2.1.4."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-307", "description": "CWE-307 Improper Restriction of Excessive Authentication Attempts"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2026-07-10T21:46:19.486Z"}}}, "cveMetadata": {"cveId": "CVE-2026-15079", "state": "PUBLISHED", "dateUpdated": "2026-07-13T17:50:54.026Z", "dateReserved": "2026-07-08T15:44:53.333Z", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "datePublished": "2026-07-10T21:46:19.486Z", "assignerShortName": "drupal"}, "dataVersion": "5.2"}