CVE-2025-14840 HTTP Client Manager - Less critical - Information disclosure - SA-CONTRIB-2025-126
An attacker can force browse to access sensitive information due to improper exception handling in the Drupal HTTP Client Manager module.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-14840?
CVE-2025-14840 is a high-severity vulnerability in Drupal HTTP Client Manager, published on 28 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal HTTP Client Manager allows Forceful Browsing.This issue affects HTTP Client Manager: from 0.0.0 before 9.3.13, from 10.0.0 before 10.0.2, from 11.0.0 before 11.0.1.
Weakness: CWE-754
Which versions are affected by CVE-2025-14840?
It affects 1 product.
Linux distribution packages (1)
drupal/http_client_manager Packagist:https://packages.drupal.org/8 | All versions | 9.3.13, 10.0.2, 11.0.1 |
Products include Bmeme Http Client Manager.
How do I fix CVE-2025-14840?
Upgrade to a fixed version.
Is CVE-2025-14840 being exploited?
There is no known exploitation of CVE-2025-14840 in the wild and no public exploit code.
Sources
Also known as DRUPAL-CONTRIB-2025-126, GHSA-wmp3-phmx-x8q8.