CVE-2026-3526

The Drupal File Access Fix (deprecated) module, versions prior to 1.2.0 , contains an incorrect authorization vulnerability. The flaw arises because the module does not consistently validate access logic when managing file storage based on entity access permissions, potentially allowing forceful ...

CVE-2026-3525

The Drupal File Access Fix (deprecated) module is vulnerable to an Incorrect Authorization flaw in versions prior to 1.2.0 . The root cause is that the module fails to sufficiently incorporate the results of the hook_file_download when implemented by custom or contributed modules, allowing for fo...