CVE-2024-13266

MEDIUM 5.3CVE-2024-13266 · DRUPAL-CONTRIB-2024-030 · Published 09/01/2025 · updated 17/06/2026

In short

CVE-2024-13266 is a MEDIUM (CVSS 5.3) vulnerability affecting drupal/responsive_menu, responsive and off-canvas menu (responsive and off-canvas menu project).
Chance of exploitation in the next 30 days (EPSS): 0.36%, higher than 29.6% of all vulnerabilities.
Fix: update to 4.4.4 or later.

Package	Affected versions	Patched versions
drupal/responsive_menu Packagist:https://packages.drupal.org/8	`< 4.4.4`	`4.4.4`
responsive and off-canvas menu responsive_and_off-canvas_menu_project	`< 4.4.4`	`4.4.4`

Description

This module integrates the mmenu library with Drupal's menu system with the aim of having an off-canvas mobile menu and a horizontal menu at wider widths.

The module doesn't respect custom node access restrictions implemented through hook_ENTITY_TYPE_access hooks meaning the titles of restricted nodes can appear in the menu.

Only sites with modules that implement hook_ENTITY_TYPE_access to restrict access to nodes are effected.

NVD description

Incorrect Authorization vulnerability in Drupal Responsive and off-canvas menu allows Forceful Browsing.This issue affects Responsive and off-canvas menu: from 0.0.0 before 4.4.4.

References

drupal.org/sa-contrib-2024-030 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free