CVE-2026-84917
CVE-2026-84917 · Jsonapi Role Access - Critical - Access bypass - SA-CONTRIB-2026-127
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This issue affects Jsonapi Role Access versions: from 0.0.0 to 2.0.2.
CVSS 6.5 · Medium · EPSS 0.2% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
jsonapi role access
- Versions
- ≥ 0.0.0, < 2.0.2: Affected (semver)
Update to 2.0.2
drupal/jsonapi_role_access Packagist:https://packages.drupal.org/8
- Affected ranges
- ECOSYSTEM: < 2.0.2
Update to 2.0.2