Live › vulnerability › CVE-2026-96389
Drupal Xray Audit is a Drupal module that fails to check authorization on some pages. An attacker can reach those pages by direct URL (forceful browsing) and see content they should not.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Drupal sites that have the Xray Audit module installed in the affected version ranges. The sources do not say which page paths are exposed or whether the module is enabled by default, so sites without the module can skip it.
No product ranges from the sources yet.
xray_audit version in the Drupal site's composer.lock or with composer show drupal/xray_auditEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in Drupal Xray Audit allows Forceful Browsing. This issue affects Xray Audit versions: from 0.0.0 to 1.6.3, from 2.0.0 to 2.0.4, from 3.0.0 to 3.1.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-96389")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.