{"id":"CVE-2026-96390","kind":"vulnerability","aliases":["CVE-2026-96390"],"related":[],"title":"Drupal Editoria11y Accessibility Checker: privilege escalation through unsafe permission actions","description":"Privilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Accessibility Checker allows Privilege Escalation. This issue affects Editoria11y Accessibility Checker versions: from 0.0.0 to 2.2.23, from 3.0.0 to 3.0.9.","summary":"The Drupal Editoria11y Accessibility Checker module defines a privilege with unsafe actions, which allows privilege escalation. An attacker with a low-privileged Drupal account could gain rights beyond what they were granted.","severity":"medium","cvss":4.3,"epss":0.00152,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","php","self-hosted"],"not_affected_if":["fixed-version","module-not-installed"],"how_to_check":"- Check the installed version of the Editoria11y Accessibility Checker module with `drush pm:list --filter=editoria11y` or in the module's `*.info.yml` file.\n- Review which roles hold the permissions this module defines in the Drupal permissions page.","fix":"- Upgrade the Editoria11y Accessibility Checker module to `2.2.24` or later in the 2.x line, or to `3.0.10` or later in the 3.x line.","status":"open","published_at":"2026-10-22T02:17:09+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:37:28+00:00","updated_at":"2026-10-25T04:37:28+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:37:28Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the Editoria11y Accessibility Checker module to `2.2.24` or later in the 2.x line, or to `3.0.10` or later in the 3.x line.","reach":"internet","title":"Drupal Editoria11y Accessibility Checker: privilege escalation through unsafe permission actions","impact":"medium","summary":"The Drupal Editoria11y Accessibility Checker module defines a privilege with unsafe actions, which allows privilege escalation. An attacker with a low-privileged Drupal account could gain rights beyond what they were granted.","category":"package","nicknames":[],"who_cares":["drupal","php","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"low-privileged Drupal user gains extra permissions","analyst_note":"Check the Drupal security advisory for the exact permissions involved and the fixed release numbers; the sources only give the affected version ranges.","how_to_check":"- Check the installed version of the Editoria11y Accessibility Checker module with `drush pm:list --filter=editoria11y` or in the module's `*.info.yml` file.\n- Review which roles hold the permissions this module defines in the Drupal permissions page.","needs_analyst":true,"not_affected_if":["module-not-installed","fixed-version"],"who_is_affected":"Sites running the Drupal Editoria11y Accessibility Checker module in the affected version ranges, from 0.0.0 to 2.2.23 and from 3.0.0 to 3.0.9. Sites without this module, or running a fixed version, are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000629,"input_tokens":3372,"output_tokens":583,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-96390':13A,16A '0.0.0':78C '2.2.23':80C '3.0.0':82C '3.0.9':84C 'access':3A,26B,65C,74C 'account':47B 'action':10A,34B,60C 'affect':72C 'allow':36B,67C 'attack':40B 'beyond':51B 'checker':4A,27B,66C,75C 'could':48B 'cve':11A,14A 'defin':29B,57C 'drupal':1A,17B,24B,46B,63C 'editoria11y':2A,25B,64C,73C 'escal':6A,38B,69C 'gain':49B 'grant':55B 'host':22B 'issu':71C 'low':44B 'low-privileg':43B 'modul':28B 'packag':18B 'permiss':9A 'php':19B 'privileg':5A,31B,37B,45B,56C,68C 'right':50B 'self':21B 'self-host':20B 'unsaf':8A,33B,59C 'version':76C 'vulner':61C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Drupal Editoria11y Accessibility Checker module in the affected version ranges, from 0.0.0 to 2.2.23 and from 3.0.0 to 3.0.9. Sites without this module, or running a fixed version, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:17:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96390","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96390","severity":null,"published_at":"2026-10-22T02:17:09+00:00","modified_at":"2026-10-22T16:54:17+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-96390","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96390","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}