{"id":"CVE-2026-96389","kind":"vulnerability","aliases":["CVE-2026-96389"],"related":[],"title":"Drupal Xray Audit: missing authorization lets users browse restricted pages","description":"Missing Authorization vulnerability in Drupal Xray Audit allows Forceful Browsing. This issue affects Xray Audit versions: from 0.0.0 to 1.6.3, from 2.0.0 to 2.0.4, from 3.0.0 to 3.1.1.","summary":"Drupal Xray Audit is a Drupal module that fails to check authorization on some pages. An attacker can reach those pages by direct URL (forceful browsing) and see content they should not.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","php","xray-audit"],"not_affected_if":["module-not-installed"],"how_to_check":"- Look up the installed `xray_audit` version in the Drupal site's composer.lock or with `composer show drupal/xray_audit`\n- Compare it against the affected ranges: 0.0.0 to 1.6.3, 2.0.0 to 2.0.4, 3.0.0 to 3.1.1","fix":"- Move to a version outside the affected ranges (fixed version not stated in the sources)","status":"open","published_at":"2026-10-30T04:18:31+00:00","first_seen_at":"2026-10-30T04:28:39+00:00","triaged_at":"2026-10-30T04:28:59+00:00","updated_at":"2026-10-30T04:28:59+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T04:28:59Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a version outside the affected ranges (fixed version not stated in the sources)","reach":"internet","title":"Drupal Xray Audit: missing authorization lets users browse restricted pages","impact":"medium","summary":"Drupal Xray Audit is a Drupal module that fails to check authorization on some pages. An attacker can reach those pages by direct URL (forceful browsing) and see content they should not.","audience":"businesses","category":"package","nicknames":[],"who_cares":["drupal","xray-audit","php"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized users read audit pages they should not see","analyst_note":"Find the Drupal security advisory for Xray Audit to get the fixed version, the affected paths and whether authentication is needed.","how_to_check":"- Look up the installed `xray_audit` version in the Drupal site's composer.lock or with `composer show drupal/xray_audit`\n- Compare it against the affected ranges: 0.0.0 to 1.6.3, 2.0.0 to 2.0.4, 3.0.0 to 3.1.1","plain_action":"","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Drupal sites that have the Xray Audit module installed in the affected version ranges. The sources do not say which page paths are exposed or whether the module is enabled by default, so sites without the module can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000681,"input_tokens":4109,"output_tokens":541,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-96389':13A,16A '0.0.0':69C '1.6.3':71C '2.0.0':73C '2.0.4':75C '3.0.0':77C '3.1.1':79C 'affect':64C 'allow':59C 'attack':39B 'audit':3A,22B,25B,58C,66C 'author':5A,34B,53C 'brows':8A,48B,61C 'check':33B 'content':51B 'cve':11A,14A 'direct':45B 'drupal':1A,17B,23B,28B,56C 'fail':31B 'forc':47B,60C 'issu':63C 'let':6A 'miss':4A,52C 'modul':29B 'packag':18B 'page':10A,37B,43B 'php':19B 'reach':41B 'restrict':9A 'see':50B 'url':46B 'user':7A 'version':67C 'vulner':54C 'xray':2A,21B,24B,57C,65C 'xray-audit':20B","nicknames":[],"mitigations":[],"who_affected":"Drupal sites that have the Xray Audit module installed in the affected version ranges. The sources do not say which page paths are exposed or whether the module is enabled by default, so sites without the module can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:18:31+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96389","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96389","severity":null,"published_at":"2026-10-30T04:18:31+00:00","modified_at":"2026-10-30T04:18:31+00:00","first_seen_at":"2026-10-30T04:28:39+00:00","fetched_at":"2026-10-30T04:28:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}