CVE-2026-114547 in TinyPNG Plugin
Summary
by MITRE • 10/30/2026
Missing Authorization vulnerability in Drupal TinyPNG allows Forceful Browsing. This issue affects TinyPNG versions: from 0.0.0 to 2.0.2.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The Drupal module known as TinyPNG, specifically within the version range of 0.0.0 through 2.0.2, contains a critical access control flaw that permits unauthorized users to interact with administrative or protected functionality without proper authentication checks. This vulnerability is classified under CWE-284, which describes Improper Access Control, and manifests as a form of Forceful Browsing where an attacker can directly invoke API endpoints or internal functions intended for authenticated administrators. The root cause lies in the module's failure to enforce sufficient authorization verification before processing requests that modify site configuration, upload images, or access sensitive data associated with image optimization services provided by TinyPNG.
From a technical perspective, the vulnerability arises because the routing definitions and controller handlers within the affected versions do not adequately validate the current user session against required permission levels for specific actions. While Drupal's core system provides robust role-based access control mechanisms, this particular module bypasses these safeguards either through misconfigured route permissions or by exposing internal service methods directly to public-facing URLs without intermediate checks. An attacker can exploit this by crafting HTTP requests that target endpoints designed exclusively for users with administrative privileges, such as those responsible for managing API keys, configuring compression settings, or accessing stored image metadata. The lack of server-side validation allows these operations to proceed successfully even when initiated from an unauthenticated context or a low-privilege user account.
The operational impact of this vulnerability is significant, particularly in environments where the TinyPNG module handles sensitive media assets or manages API credentials that grant access to third-party compression services. Successful exploitation could allow attackers to escalate privileges by manipulating site settings, potentially leading to further compromise such as remote code execution if combined with other vulnerabilities like insecure deserialization or command injection within related modules. Additionally, unauthorized modification of image processing configurations may result in denial-of-service conditions through resource exhaustion or data integrity issues due to improper handling of uploaded files. In multi-tenant Drupal installations, this flaw could also facilitate cross-site request forgery attacks if session tokens are not properly validated alongside authorization checks.
Mitigation strategies must prioritize immediate remediation by upgrading the TinyPNG module to a version greater than 2.0.2 where these access control issues have been addressed through rigorous input validation and strict permission enforcement aligned with Drupal’s security best practices. Until an upgrade is feasible, administrators should implement network-level controls such as web application firewalls that inspect request headers for anomalies indicative of unauthorized access attempts. It is also advisable to restrict direct access to module-specific endpoints via server configuration rules while monitoring logs for suspicious activity patterns consistent with forceful browsing attacks. Regular security audits and penetration testing focusing on authorization bypass scenarios will help identify similar weaknesses in other custom or contributed modules, ensuring a more resilient defense posture against privilege escalation threats aligned with MITRE ATT&CK techniques related to initial access and persistence through misconfigured services.