PT-2026-84893

Name of the Vulnerable Software and Affected Versions Jsonapi Role Access versions 0.0.0 through 2.0.2 Description An incorrect authorization issue exists in the module used to restrict access to JSON:API routes based on user roles. The module fails to sufficiently enforce access controls when a...

EUVD-2022-0799

Malicious code in bioql PyPI...

CVE-2023-5256: Exposure of Sensitive Information to an Unauthorized Actor

In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation. This vulnerability only affects sites with the JSON:API module enabled,...

CVE-2020-13677

Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access bypass. Sites that do not have the JSON:API module enabled are not affected...