CVE-2007-4436: The Drupal Project module before 5.x-1.0, 4.7.x-2.3, and 4.7.x-1.3 and Project issue tracking module before...

Security readout for executives and security teams

CVE-2007-4436 is an information disclosure flaw in legacy Drupal Project and Project issue tracking modules. The modules failed to enforce permissions, allowing remote users to see sensitive project-related information through tracker, recent posts, statistics, project-name, and CVS activity views. Exposure is most likely on old Drupal 4.7 or 5.x sites that installed the Project or Project issue tracking modules and still publish project, tracker, statistics, or CVS activity pages. Treat this as a targeted legacy-platform risk, not a current internet-wide emergency. Prioritize if the organization still runs old Drupal project-tracking sites with sensitive internal project names or activity data. Mitigation focus: Upgrade the Project module to a non-affected version named in the advisory.; Upgrade Project issue tracking to a non-affected version named in the advisory.; Check Drupal vendor guidance for any branch-specific upgrade or configuration notes..

Prepared

Jun 29, 2026, 03:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.