Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    Related vulnerabilities

    DRUPAL-CONTRIB-2026-206 (CVE-2026-96389)

    Vulnerability from drupal – Published: 2026-10-07 16:30 – Updated: 2026-10-07 19:50 – Source website
    VLAI
    Details

    This module enables you to audit a Drupal site by generating reports about its content, entities, display modes and configuration.

    The module doesn't sufficiently check entity access when rendering an entity through the display-mode example route. This allows an attacker to view unpublished or otherwise access-restricted content.

    This vulnerability is mitigated by the fact that field-level access is still enforced, so fields that are themselves access-restricted (for example a user's email or password hash) are not disclosed.

    Credits
    Drew Webber (mcdruid) www.drupal.org/u/mcdruid
    Hemant Gupta (guptahemant) www.drupal.org/u/guptahemant
    Marcus Johansson (marcus_johansson) www.drupal.org/u/marcus_johansson
    eduardo morales alberti www.drupal.org/u/eduardo-morales-alberti
    References
    To clipboard 

    {
  "affected": [
    {
      "database_specific": {
        "affected_versions": "\u003c1.6.3 || \u003e=2.0.0 \u003c2.0.4 || \u003e=3.0.0 \u003c3.1.1"
      },
      "package": {
        "ecosystem": "Packagist:https://packages.drupal.org/8",
        "name": "drupal/xray_audit"
      },
      "ranges": [
        {
          "database_specific": {
            "constraint": "\u003c1.6.3"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.6.3"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "database_specific": {
            "constraint": "\u003e=2.0.0 \u003c2.0.4"
          },
          "events": [
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "2.0.4"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "database_specific": {
            "constraint": "\u003e=3.0.0 \u003c3.1.1"
          },
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.1.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": []
    }
  ],
  "aliases": [
    "CVE-2026-96389"
  ],
  "credits": [
    {
      "contact": [
        "https://www.drupal.org/u/mcdruid"
      ],
      "name": "Drew Webber (mcdruid)"
    },
    {
      "contact": [
        "https://www.drupal.org/u/guptahemant"
      ],
      "name": "Hemant Gupta (guptahemant)"
    },
    {
      "contact": [
        "https://www.drupal.org/u/marcus_johansson"
      ],
      "name": "Marcus Johansson (marcus_johansson)"
    },
    {
      "contact": [
        "https://www.drupal.org/u/eduardo-morales-alberti"
      ],
      "name": "eduardo morales alberti"
    }
  ],
  "details": "This module enables you to audit a Drupal site by generating reports about its content, entities, display modes and configuration.\n\nThe module doesn\u0027t sufficiently check entity access when rendering an entity through the display-mode example route. This allows an attacker to view unpublished or otherwise access-restricted content.\n\nThis vulnerability is mitigated by the fact that field-level access is still enforced, so fields that are themselves access-restricted (for example a user\u0027s email or password hash) are not disclosed.",
  "id": "DRUPAL-CONTRIB-2026-206",
  "modified": "2026-10-07T19:50:05.000Z",
  "published": "2026-10-07T16:30:05.000Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-contrib-2026-206"
    }
  ],
  "schema_version": "1.7.0"
}