{"id":"DRUPAL-CONTRIB-2026-216","aliases":["CVE-2026-107255"],"title":"DRUPAL-CONTRIB-2026-216","description":"This module enables you to restrict access to routes by IP address.\n\nThe module doesn't reliably restrict a subset of dynamic routes, leading to an access bypass vulnerability. The impact depends on how a site uses this module and whether it has any routes that are dynamic.","severity":"unknown","score":null,"published":"2026-10-07T16:55:41.000Z","modified":"2026-10-07T20:15:06.001Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist:https://packages.drupal.org/8","name":"drupal/restrict_route_by_ip","ranges":[{"events":[{"introduced":"0"},{"fixed":"1.3.1"}],"type":"ECOSYSTEM","database_specific":{"constraint":"<1.3.1"}},{"events":[{"introduced":"2.0.0"},{"fixed":"2.0.1"}],"type":"ECOSYSTEM","database_specific":{"constraint":">=2.0.0 <2.0.1"}}],"versions":[],"fixed":["1.3.1","2.0.1"]}],"sourceAffected":[],"references":["https://www.drupal.org/sa-contrib-2026-216"],"sources":[{"name":"OSV","id":"DRUPAL-CONTRIB-2026-216","modified":"2026-10-07T20:15:06.001931300Z","url":"https://osv.dev/vulnerability/DRUPAL-CONTRIB-2026-216"}],"assessments":[]}