CVE-2026-3525

The CVE-2026-3525 issue affects Drupal File Access Fix (deprecated) prior to version 1.2.0. The root cause is an incorrect authorization check that enables forceful browsing, potentially permitting access to sensitive files or resources. Red Hat and ENISA entries describe an improper file access ...

CVE-2026-3526

The Drupal File Access Fix (deprecated) module versions prior to 1.2.0 are vulnerable to an incorrect authorization flaw. The module is designed to manage file storage based on entity access permissions, but it fails to consistently validate access logic, which can allow an attacker to perform fo...