Hi, may I get a CVE ID for the fix of:

[D7ES] Access Bypass via Unconditional Download Headers
https://git.drupalcode.org/security/185424-file_force-security/-/work_it...

I looked for an existing CVE to update and this one, though similar and referenced in the above, isn't close enough:

Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010
https://www.drupal.org/sa-core-2026-010

Attached is the JSON; I couldn't find a link for Tag1 but if they provide it I'm happen to add it.

CommentFileSizeAuthor
#6 CVE-2026-110176.json_.txt7.85 KBaangel
#2 file_force-cve-xxxx-xxxxx.json_.txt6.42 KBaangel

Comments

aangel created an issue. See original summary.

aangel’s picture

aangel commented
Issue summary: View changes
StatusFileSize
new file_force-cve-xxxx-xxxxx.json_.txt6.42 KB
greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented
Status: Active » Needs review
aangel’s picture

aangel commented

Good day and Happy Monday...possible to get this ID?

Cheers,
André

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented
Title: Request for CVE for File Force fix » Publish CVE-2026-110176 CVE for File Force fix
Status: Needs review » Needs work

Reserved CVE-2026-110176

Back to needs work for the HD publishing and then we can add that link.

I think the CVE is missing a few other fields like the reporter and fixers as well.

aangel’s picture

aangel commented
StatusFileSize
new CVE-2026-110176.json_.txt7.85 KB

Update with links to HD and Tag1 plus the reporter/fixer.

Ready for publishing?

aangel’s picture

aangel commented
Status: Needs work » Needs review