CVE-2026-107255 in Restrict route by IP Plugin
Summary
by MITRE • 10/30/2026
Incorrect Authorization vulnerability in Drupal Restrict route by IP allows Forceful Browsing. This issue affects Restrict route by IP versions: from 0.0.0 to 1.3.1, from 2.0.0 to 2.0.1.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/30/2026
The Drupal module known as Restrict Route by IP is designed to limit access to specific administrative or sensitive routes based on the client's source Internet Protocol address. This security control mechanism relies heavily on accurate identification of the requester's origin, typically through standard HTTP headers such as X-Forwarded-For when operating behind reverse proxies or load balancers. The vulnerability identified in versions ranging from 0.0.0 to 1.3.1 and from 2.0.0 to 2.0.1 stems from an incorrect authorization logic that fails to properly validate the integrity of these IP address indicators. Specifically, the module does not adequately verify whether the reported client IP has been spoofed or manipulated by a malicious actor situated between the user and the web server. This flaw allows for forceful browsing attacks where unauthorized users can bypass IP-based restrictions by manipulating network headers to masquerade as an allowed internal or trusted address.
From a technical perspective, this vulnerability is classified under CWE-284 Improper Access Control, which encompasses scenarios where access controls are not enforced correctly during the authorization phase of authentication processes. The root cause lies in the module's reliance on untrusted input for critical security decisions without implementing sufficient validation checks against header injection or proxy spoofing techniques. In environments utilizing reverse proxies like Nginx or Apache configured to pass client information via headers, an attacker can inject arbitrary values into these fields if the application does not cross-reference them with known trusted proxy IPs or enforce strict filtering rules. Consequently, the authorization check passes erroneously because it perceives the request as originating from a whitelisted IP address rather than the actual external source attempting to gain access.
The operational impact of this vulnerability is significant for Drupal sites that rely on Restrict Route by IP to protect sensitive administrative interfaces or custom endpoints containing confidential data. An attacker exploiting this flaw can perform forceful browsing, gaining unauthorized entry into areas intended only for specific network segments or trusted administrators. This could lead to the exposure of configuration details, user credentials, database structures, or other proprietary information that should remain inaccessible from public networks. Furthermore, if these restricted routes include functionality for managing users or content, an attacker might escalate privileges by manipulating administrative functions available within those protected areas, potentially leading to full site compromise and data exfiltration.
To mitigate this risk, administrators must upgrade the Restrict Route by IP module to a version that addresses these authorization flaws, ensuring that proper validation mechanisms are in place for all incoming requests. It is also recommended to implement defense-in-depth strategies at the web server or reverse proxy level rather than relying solely on application-level checks. Configuring trusted proxies correctly so they overwrite untrusted headers with verified client IPs can prevent spoofing attempts. Additionally, organizations should review their access control policies and consider implementing multi-factor authentication for administrative routes as an additional layer of security. Regular auditing of authorization logic against industry standards such as the OWASP Top Ten will help identify similar weaknesses in other modules or custom code before they can be exploited by malicious actors seeking to bypass network-based restrictions.