CVE-2026-96390

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-96390

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-96390.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-96390

Aliases

DRUPAL-CONTRIB-2026-185

Published

2026-10-22T01:21:22Z

Modified

2026-10-23T02:46:13Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Summary

Editoria11y Accessibility Checker - Moderately critical - Access bypass - SA-CONTRIB-2026-185

Details

Privilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Accessibility Checker allows Privilege Escalation. This issue affects Editoria11y Accessibility Checker versions: from 0.0.0 to 2.2.23, from 3.0.0 to 3.0.9.

Database specific

{
    "cna_assigner":  "drupal",
    "cwe_ids":  [
        "CWE-267"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/96xxx/CVE-2026-96390.json"
}

References

Affected packages

Git / git.drupalcode.org/project/editoria11y

Affected ranges

Type

GIT

Repo

https://git.drupalcode.org/project/editoria11y

Events

Introduced

Fixed

4a5415bfcadb0e8ecb7fd00d7727f66d8f50c021

Introduced

ae11f3647c36ed328e0127db7bf31c4f4fa21007

Fixed

43edc61ba62bae400176c19b0848c00dcae919d1

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0.0.0"
                },
                {
                    "fixed":  "2.2.23"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "introduced":  "3.0.0"
                },
                {
                    "fixed":  "3.0.9"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        }
    ]
}

Affected versions

1.*

1.0.0

1.0.0-Beta

1.0.0-Beta1

1.0.0-alpha1

1.0.0-alpha10

1.0.0-alpha2

1.0.0-alpha3

1.0.0-alpha4

1.0.0-alpha5

1.0.0-alpha6

1.0.0-alpha7

1.0.0-alpha8

1.0.0-alpha9

1.0.0-beta1

1.0.0-beta10

1.0.0-beta2

1.0.0-beta3

1.0.0-beta4

1.0.0-beta5

1.0.0-beta6

1.0.0-beta7

1.0.0-beta8

1.0.0-beta9

1.0.1

1.0.10

1.0.11

1.0.12

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

1.0.7

1.0.8

1.0.9

2.*

2.0.0

2.0.0-alpha1

2.0.0-alpha2

2.0.0-alpha3

2.0.0-alpha4

2.0.0-alpha5

2.0.0-alpha6

2.0.0-alpha7

2.0.0-alpha8

2.0.0-beta1

2.0.0-beta10

2.0.0-beta11

2.0.0-beta12

2.0.0-beta2

2.0.0-beta3

2.0.0-beta4

2.0.0-beta5

2.0.0-beta6

2.0.0-beta7

2.0.0-beta8

2.0.0-beta9

2.0.1

2.0.10

2.0.11

2.0.12

2.0.13

2.0.14

2.0.2

2.0.3

2.0.4

2.0.5

2.0.6

2.0.7

2.0.8

2.0.9

2.1.0

2.1.1

2.1.10

2.1.11

2.1.12

2.1.13

2.1.14

2.1.15

2.1.16

2.1.17

2.1.18

2.1.19

2.1.2

2.1.3

2.1.4

2.1.5

2.1.6

2.1.7

2.1.8

2.1.9

2.2-rc2

2.2.0

2.2.0-beta1

2.2.0-beta2

2.2.0-beta3

2.2.0-beta4

2.2.0-beta5

2.2.0-beta6

2.2.0-rc1

2.2.0-rc10

2.2.0-rc2

2.2.0-rc3

2.2.0-rc4

2.2.0-rc5

2.2.0-rc6

2.2.0-rc7

2.2.0-rc8

2.2.0-rc9

2.2.1

2.2.10

2.2.11

2.2.12

2.2.13

2.2.14

2.2.15

2.2.16

2.2.17

2.2.18

2.2.19

2.2.2

2.2.20

2.2.21

2.2.22

2.2.3

2.2.4

2.2.5

2.2.6

2.2.7

2.2.8

2.2.9

3.*

3.0.0

3.0.0-rc2

3.0.1

3.0.2

3.0.3

3.0.4

3.0.5

3.0.6

3.0.7

3.0.8

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-96390.json"