CVE-2026-84917

The Jsonapi Role Access module for Drupal (versions 0.0.0 through 2.0.2 ) is vulnerable to an incorrect authorization issue. The module fails to sufficiently enforce access controls when a request mimics an XMLHttpRequest , which can allow Forceful Browsing by bypassing intended role-based restri...

CVE-2026-84917 Jsonapi Role Access - Critical - Access bypass - SA-CONTRIB-2026-127

Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This issue affects Jsonapi Role Access versions: from 0.0.0 to 2.0.2...

CVE-2026-84917 Jsonapi Role Access - Critical - Access bypass - SA-CONTRIB-2026-127

Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This issue affects Jsonapi Role Access versions: from 0.0.0 to 2.0.2...

EUVD-2026-107872

Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This issue affects Jsonapi Role Access versions: from 0.0.0 to 2.0.2...

CVE-2026-84917

Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This issue affects Jsonapi Role Access versions: from 0.0.0 to 2.0.2...

CVE-2026-84916

Missing Authorization vulnerability in Drupal Islandora allows Forceful Browsing. This issue affects Islandora versions: from 0.0.0 to 2.19.0...

CVE-2026-84916 Islandora - Moderately critical - Access bypass - SA-CONTRIB-2026-126

Missing Authorization vulnerability in Drupal Islandora allows Forceful Browsing. This issue affects Islandora versions: from 0.0.0 to 2.19.0...

CVE-2026-84916

The Islandora software (versions 0.0.0 through 2.19.0) contains a Missing Authorization vulnerability in the islandora_advanced_search submodule. The issue stems from a failure to sufficiently verify block access when arbitrary block IDs are submitted to a publicly accessible AJAX endpoint . This...

CVE-2026-84917 Jsonapi Role Access - Critical - Access bypass - SA-CONTRIB-2026-127

Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This issue affects Jsonapi Role Access versions: from 0.0.0 to 2.0.2...

CVE-2026-84920

Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful Browsing. This issue affects Unpublished Node Permissions versions: from 0.0.0 to 1.8.0...

CVE-2026-84921

Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing. This issue affects Webform Submissions Delete versions: from 0.0.0 to 1.2.0...

CVE-2026-87938

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Drupal CSP log allows SQL Injection. This issue affects CSP log versions: from 0.0.0 to 1.0.2...

CVE-2026-87940 Key auth - Moderately critical - Access bypass - SA-CONTRIB-2026-138

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Key auth versions: from 0.0.0 to 2.2.4...

CVE-2026-87940

The Drupal Key auth module (versions 0.0.0 through 2.2.4 ) is vulnerable to a Use of Web Browser Cache Containing Sensitive Information issue. The root cause is that the module fails to cache data on a per-user basis, which may allow an attacker with identical permissions to view another user's a...

EUVD-2026-107861

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Key auth versions: from 0.0.0 to 2.2.4...

CVE-2026-87940 Key auth - Moderately critical - Access bypass - SA-CONTRIB-2026-138

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Key auth versions: from 0.0.0 to 2.2.4...

CVE-2026-87940 Key auth - Moderately critical - Access bypass - SA-CONTRIB-2026-138

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Key auth versions: from 0.0.0 to 2.2.4...

CVE-2026-87943

Missing Authorization vulnerability in Drupal SAML SSO - Service Provider allows Forceful Browsing. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0...

CVE-2026-87953

Server-Side Request Forgery SSRF vulnerability in Drupal SAML SSO - Service Provider allows Server Side Request Forgery. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0...

CVE-2026-87954 Taxonomy Term Glossary - Critical - Access bypass - SA-CONTRIB-2026-152

Missing Authorization vulnerability in Drupal Taxonomy Term Glossary allows Forceful Browsing. This issue affects Taxonomy Term Glossary versions: from 0.0.0 to 4.6.0...