DRUPAL-CONTRIB-2026-185

See a problem?
Import Source
https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/editoria11y/DRUPAL-CONTRIB-2026-185.json
JSON Data
https://api.osv.dev/v1/vulns/DRUPAL-CONTRIB-2026-185
Aliases
  • CVE-2026-96390
Published
2026-09-23T17:18:31Z
Modified
2026-09-23T19:15:05Z
Summary
[none]
Details

This module runs a client-side accessibility checker that automatically reports results to dashboard views over an API.

The module incorrectly described a permission as a "view" permission when it grants edit and delete access to module data, resulting in a potential access bypass.

References
Credits

Affected packages

Packagist:https://packages.drupal.org/8 / drupal/editoria11y

Package

Name
drupal/editoria11y
Purl
pkg:composer/drupal/editoria11y?repository_url=https:%2F%2Fpackages.drupal.org%2F8

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.2.23
Database specific
Show details 
{
    "constraint":  "<2.2.23"
}
Type
ECOSYSTEM
Events
Introduced
3.0.0
Fixed
3.0.9
Database specific
Show details 
{
    "constraint":  ">=3.0.0 <3.0.9"
}

Database specific

affected_versions 
"<2.2.23 || >=3.0.0 <3.0.9"
source 
"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/editoria11y/DRUPAL-CONTRIB-2026-185.json"