Live › vulnerability › CVE-2026-84917
Go to dashboardThe Drupal JSON:API Role Access module does not enforce its role-based access rules correctly, so requests can reach resources that should be hidden from the caller. An attacker can read data by requesting URLs directly (forceful browsing).
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Drupal JSON:API Role Access module at version 2.0.2 or earlier that expose JSON:API endpoints with role-restricted content. Sites without the module, or without JSON:API exposed, are not affected.
No product ranges from the sources yet.
jsonapi_role_access module with drush pm:list --filter=jsonapi_role_access or composer show drupal/jsonapi_role_accessdrush pm:list --status=enabled2.0.2 (the advisory lists 2.0.2 as affected; check the project page for the fixed release)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This issue affects Jsonapi Role Access versions: from 0.0.0 to 2.0.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-84917")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.