Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
Related vulnerabilities
DRUPAL-CONTRIB-2026-126 (CVE-2026-84916)
Vulnerability from drupal – Published: 2026-09-02 16:32 – Updated: 2026-09-02 16:32 – Source website
VLAI
Details
This islandora_advanced_search sub module enables AJAX updates for advanced search, facet, and search result blocks.
The module doesn't sufficiently check block access when arbitrary block ID's are submitted to its publicly accessible AJAX endpoint. This may allow an unauthenticated attacker to retrieve restricted block content.
This vulnerability is mitigated by the fact that an attacker must know or guess a restricted block’s machine ID, and the block must contain sensitive content protected by block access or visibility restrictions. Additionally, the submodule is not known to be used by any modern Islandora configurations.
Credits
References
| URL | Type | |
|---|---|---|
{
"affected": [
{
"database_specific": {
"affected_versions": "\u003c2.19.0"
},
"package": {
"ecosystem": "Packagist:https://packages.drupal.org/8",
"name": "drupal/islandora"
},
"ranges": [
{
"database_specific": {
"constraint": "\u003c2.19.0"
},
"events": [
{
"introduced": "0"
},
{
"fixed": "2.19.0"
}
],
"type": "ECOSYSTEM"
}
],
"severity": []
}
],
"aliases": [
"CVE-2026-84916"
],
"credits": [
{
"contact": [
"https://www.drupal.org/u/joecorall"
],
"name": "Joe Corall (joecorall)"
}
],
"details": "This `islandora_advanced_search` sub module enables AJAX updates for advanced search, facet, and search result blocks.\n\nThe module doesn\u0027t sufficiently check block access when arbitrary block ID\u0027s are submitted to its publicly accessible AJAX endpoint. This may allow an unauthenticated attacker to retrieve restricted block content.\n\nThis vulnerability is mitigated by the fact that an attacker must know or guess a restricted block\u2019s machine ID, and the block must contain sensitive content protected by block access or visibility restrictions. Additionally, the submodule is not known to be used by any modern Islandora configurations.",
"id": "DRUPAL-CONTRIB-2026-126",
"modified": "2026-09-02T16:32:46.000Z",
"published": "2026-09-02T16:32:46.000Z",
"references": [
{
"type": "WEB",
"url": "https://www.drupal.org/sa-contrib-2026-126"
}
],
"schema_version": "1.7.0"
}