CVE-2026-3525

The Drupal File Access Fix (deprecated) module is vulnerable to an Incorrect Authorization flaw in versions prior to 1.2.0 . The root cause is that the module fails to sufficiently incorporate the results of the hook_file_download when implemented by custom or contributed modules, allowing for fo...