Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
Related vulnerabilities
DRUPAL-CONTRIB-2026-118 (CVE-2026-84910)
Vulnerability from drupal – Published: 2026-09-02 16:25 – Updated: 2026-09-02 16:25 – Source website
VLAI
Details
This module enables AJAX updates for advanced search, facet, and search result blocks.
The module doesn’t sufficiently check block access when arbitrary block IDs are submitted to its publicly accessible AJAX endpoint. This may allow an unauthenticated attacker to retrieve restricted block content.
This vulnerability is mitigated by the fact that an attacker must know or guess a restricted block’s machine ID, and the block must contain sensitive content protected by block access or visibility restrictions.
References
| URL | Type | |
|---|---|---|
{
"affected": [
{
"database_specific": {
"affected_versions": "\u003c2.4.5"
},
"package": {
"ecosystem": "Packagist:https://packages.drupal.org/8",
"name": "drupal/advanced_search"
},
"ranges": [
{
"database_specific": {
"constraint": "\u003c2.4.5"
},
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.5"
}
],
"type": "ECOSYSTEM"
}
],
"severity": []
}
],
"aliases": [
"CVE-2026-84910"
],
"credits": [
{
"contact": [
"https://www.drupal.org/u/marcus_johansson"
],
"name": "Marcus Johansson (marcus_johansson)"
}
],
"details": "This module enables AJAX updates for advanced search, facet, and search result blocks.\n\nThe module doesn\u2019t sufficiently check block access when arbitrary block IDs are submitted to its publicly accessible AJAX endpoint. This may allow an unauthenticated attacker to retrieve restricted block content.\n\nThis vulnerability is mitigated by the fact that an attacker must know or guess a restricted block\u2019s machine ID, and the block must contain sensitive content protected by block access or visibility restrictions.",
"id": "DRUPAL-CONTRIB-2026-118",
"modified": "2026-09-02T16:25:51.000Z",
"published": "2026-09-02T16:25:51.000Z",
"references": [
{
"type": "WEB",
"url": "https://www.drupal.org/sa-contrib-2026-118"
}
],
"schema_version": "1.7.0"
}