PT-2026-137308

Islandora does not sufficiently check file update access when processing media source and derivative uploads. A user with permission to update media or create derivatives can submit a crafted request to overwrite files they are not authorized to modify, including private files. The Islandora Text...

CVE-2026-84916

Missing Authorization vulnerability in Drupal Islandora allows Forceful Browsing. This issue affects Islandora versions: from 0.0.0 to 2.19.0...

CVE-2026-84916

The Islandora software (versions 0.0.0 through 2.19.0) contains a Missing Authorization vulnerability in the islandora_advanced_search submodule. The issue stems from a failure to sufficiently verify block access when arbitrary block IDs are submitted to a publicly accessible AJAX endpoint . This...

CVE-2026-84916

Missing Authorization vulnerability in Drupal Islandora allows Forceful Browsing. This issue affects Islandora versions: from 0.0.0 to 2.19.0...

CVE-2026-84916 Islandora - Moderately critical - Access bypass - SA-CONTRIB-2026-126

Missing Authorization vulnerability in Drupal Islandora allows Forceful Browsing. This issue affects Islandora versions: from 0.0.0 to 2.19.0...

CVE-2026-84916 Islandora - Moderately critical - Access bypass - SA-CONTRIB-2026-126

Missing Authorization vulnerability in Drupal Islandora allows Forceful Browsing. This issue affects Islandora versions: from 0.0.0 to 2.19.0...

EUVD-2026-107873

Missing Authorization vulnerability in Drupal Islandora allows Forceful Browsing. This issue affects Islandora versions: from 0.0.0 to 2.19.0...

CVE-2026-84916 Islandora - Moderately critical - Access bypass - SA-CONTRIB-2026-126

Missing Authorization vulnerability in Drupal Islandora allows Forceful Browsing. This issue affects Islandora versions: from 0.0.0 to 2.19.0...

Drupal Islandora authorization issue vulnerability

Drupal Islandora versions 0.0.0 through 2.19.0 contain an authorization issue vulnerability stemming from missing authorization checks, which may lead to forced browsing...

PT-2026-84892

Name of the Vulnerable Software and Affected Versions Islandora versions 0.0.0 through 2.19.0 Description The islandora advanced search submodule fails to sufficiently verify block access when arbitrary block IDs are submitted to its publicly accessible AJAX endpoint. This flaw allows an...

Islandora - Moderately critical - Access bypass - SA-CONTRIB-2026-126

This islandoraadvancedsearch sub module enables AJAX updates for advanced search, facet, and search result blocks. The module doesn't sufficiently check block access when arbitrary block ID's are submitted to its publicly accessible AJAX endpoint. This may allow an unauthenticated attacker to...

ca.islandora.alpaca:islandora-alpaca-app (>=2.0.0, <=2.2.0), ca.islandora.alpaca:islandora-connector-derivative (>=2.0.0, <=2.2.0) +28 more potentially affected by CVE-2026-43866 via org.apache.camel:camel-activemq (>=3.0.0, <=4.14.7)

org.apache.camel:camel-activemq MAVEN version =3.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =0.46, =0.3, =0.5, =0.1, =0.1, =6.0.0, =1.6.0, =0.1.0, =0.11.5 and more Source cves: CVE-2026-43866 Source advisory: MEND:CVE-2026-43866...

ca.islandora.alpaca:islandora-connector-broadcast (>=0.2.0, <=0.3.0), ca.islandora.alpaca:islandora-indexing-triplestore (0.1.0) +545 more potentially affected by CVE-2026-41849 via org.springframework:spring-expression (4.1.9.release)

org.springframework:spring-expression MAVEN version 4.1.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ca.islandora.alpaca:islandora-connector-broadcast =0.2.0, =1.0.0, =2.0.0-rc2,...

ca.islandora.alpaca:islandora-connector-broadcast (>=0.2.0, <=0.3.0), ca.islandora.alpaca:islandora-indexing-triplestore (0.1.0) +545 more potentially affected by CVE-2026-41850 via org.springframework:spring-expression (4.1.9.release)

org.springframework:spring-expression MAVEN version 4.1.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ca.islandora.alpaca:islandora-connector-broadcast =0.2.0, =1.0.0, =2.0.0-rc2,...

ca.islandora.alpaca:islandora-connector-broadcast (>=0.2.0, <=0.3.0), ca.islandora.alpaca:islandora-indexing-triplestore (0.1.0) +545 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (4.1.9.release)

org.springframework:spring-expression MAVEN version 4.1.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ca.islandora.alpaca:islandora-connector-broadcast =0.2.0, =1.0.0, =2.0.0-rc2,...

ca.islandora.alpaca:islandora-alpaca-app (>=2.0.0, <=2.2.0), ca.islandora.alpaca:islandora-connector-derivative (>=2.0.0, <=2.2.0) +28 more potentially affected by CVE-2026-40860 via org.apache.camel:camel-activemq (>=3.0.0, <=4.14.6)

org.apache.camel:camel-activemq MAVEN version =3.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =0.46, =0.3, =0.5, =0.1, =0.1, =6.0.0, =1.6.0, =0.1.0, =0.11.5 and more Source cves: CVE-2026-40860 Source advisory: GHSA-M5VH-3FW5-5WGH...

ca.islandora.alpaca:islandora-alpaca-app (>=2.0.0, <=2.2.0), ca.islandora.alpaca:islandora-connector-derivative (>=2.0.0, <=2.2.0) +81 more potentially affected by CVE-2026-40860 via org.apache.camel:camel-jms (>=3.0.0, <=4.14.6)

org.apache.camel:camel-jms MAVEN version =3.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =3.0.0, =0.46, =0.3, =0.5, =0.1, =0.1, =1.0, =hyte-mq-4.3.7.hyte-43072, =hyte-mq-4.3.7.hyte-43072, =4.4.11.hyte-26354 and more Source cves: CVE-2026-40860 Source advisory: OSV:GHSA-M5VH-3FW5-5WGH...

CVE-2026-3215

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Islandora allows Cross-Site Scripting XSS.This issue affects Islandora: from 0.0.0 before 2.17.5...

EUVD-2026-15474

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Islandora allows Cross-Site Scripting XSS.This issue affects Islandora: from 0.0.0 before 2.17.5...

CVE-2026-3215

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Islandora allows Cross-Site Scripting XSS.This issue affects Islandora: from 0.0.0 before 2.17.5...