CVE-2026-84917

Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This issue affects Jsonapi Role Access versions: from 0.0.0 to 2.0.2...

CVE-2026-84917 Jsonapi Role Access - Critical - Access bypass - SA-CONTRIB-2026-127

Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This issue affects Jsonapi Role Access versions: from 0.0.0 to 2.0.2...

CVE-2026-84917

The Jsonapi Role Access module for Drupal (versions 0.0.0 through 2.0.2 ) is vulnerable to an incorrect authorization issue. The module fails to sufficiently enforce access controls when a request mimics an XMLHttpRequest , which can allow Forceful Browsing by bypassing intended role-based restri...

EUVD-2026-107872

Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This issue affects Jsonapi Role Access versions: from 0.0.0 to 2.0.2...

Jsonapi Role Access - Critical - Access bypass - SA-CONTRIB-2026-127

This module enables you to restrict access to JSON:API routes based on specific user roles. The module doesn't sufficiently enforce access controls under scenarios where a request mimics an XMLHttpRequest...