{"id":"CVE-2026-84917","kind":"vulnerability","aliases":["CVE-2026-84917"],"related":[],"title":"Drupal JSON:API Role Access: incorrect authorization lets users browse restricted content","description":"Incorrect Authorization vulnerability in Drupal Jsonapi Role Access  allows Forceful Browsing. This issue affects Jsonapi Role Access  versions: from 0.0.0 to 2.0.2.","summary":"The Drupal JSON:API Role Access module does not enforce its role-based access rules correctly, so requests can reach resources that should be hidden from the caller. An attacker can read data by requesting URLs directly (forceful browsing).","severity":"medium","cvss":6.5,"epss":0.00194,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","php","self-hosted"],"not_affected_if":["jsonapi-disabled","module-not-installed"],"how_to_check":"- Check the installed version of the `jsonapi_role_access` module with `drush pm:list --filter=jsonapi_role_access` or `composer show drupal/jsonapi_role_access`\n- Confirm the module is enabled with `drush pm:list --status=enabled`","fix":"- Update the Drupal JSON:API Role Access module to a version later than `2.0.2` (the advisory lists 2.0.2 as affected; check the project page for the fixed release)\n- Until updated, review role permissions on JSON:API endpoints","status":"open","published_at":"2026-10-22T02:17:02+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T03:48:42+00:00","updated_at":"2026-10-25T03:48:42+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T03:48:42Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Drupal JSON:API Role Access module to a version later than `2.0.2` (the advisory lists 2.0.2 as affected; check the project page for the fixed release)\n- Until updated, review role permissions on JSON:API endpoints","reach":"internet","title":"Drupal JSON:API Role Access: incorrect authorization lets users browse restricted content","impact":"medium","summary":"The Drupal JSON:API Role Access module does not enforce its role-based access rules correctly, so requests can reach resources that should be hidden from the caller. An attacker can read data by requesting URLs directly (forceful browsing).","category":"package","nicknames":[],"who_cares":["drupal","php","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Restricted content readable by users without the required role","analyst_note":"Sources give only the description and affected range 0.0.0 to 2.0.2; find the Drupal.org advisory and fixed version, and confirm whether authentication is needed.","how_to_check":"- Check the installed version of the `jsonapi_role_access` module with `drush pm:list --filter=jsonapi_role_access` or `composer show drupal/jsonapi_role_access`\n- Confirm the module is enabled with `drush pm:list --status=enabled`","needs_analyst":true,"not_affected_if":["module-not-installed","jsonapi-disabled"],"who_is_affected":"Sites running the Drupal JSON:API Role Access module at version 2.0.2 or earlier that expose JSON:API endpoints with role-restricted content. Sites without the module, or without JSON:API exposed, are not affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000638,"input_tokens":3335,"output_tokens":608,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-84917':15A,18A '0.0.0':84C '2.0.2':86C 'access':5A,30B,39B,72C,81C 'affect':78C 'allow':73C 'api':3A,28B 'attack':55B 'author':7A,66C 'base':38B 'brows':10A,64B,75C 'caller':53B 'content':12A 'correct':41B 'cve':13A,16A 'data':58B 'direct':62B 'drupal':1A,19B,26B,69C 'enforc':34B 'forc':63B,74C 'hidden':50B 'host':24B 'incorrect':6A,65C 'issu':77C 'json':2A,27B 'jsonapi':70C,79C 'let':8A 'modul':31B 'packag':20B 'php':21B 'reach':45B 'read':57B 'request':43B,60B 'resourc':46B 'restrict':11A 'role':4A,29B,37B,71C,80C 'role-bas':36B 'rule':40B 'self':23B 'self-host':22B 'url':61B 'user':9A 'version':82C 'vulner':67C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Drupal JSON:API Role Access module at version 2.0.2 or earlier that expose JSON:API endpoints with role-restricted content. Sites without the module, or without JSON:API exposed, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:17:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-84917","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84917","severity":null,"published_at":"2026-10-22T02:17:02+00:00","modified_at":"2026-10-22T18:17:30+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-84917","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-84917","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}