{"id":"CVE-2026-3526","aliases":["DRUPAL-CONTRIB-2026-021","EUVD-2026-16377","GHSA-9pv3-cpwf-mpmj"],"status":"published","title":"File Access Fix (deprecated) - Moderately critical - Access bypass - SA-CONTRIB-2026-021","description":"Incorrect Authorization vulnerability in Drupal File Access Fix (deprecated) allows Forceful Browsing.This issue affects File Access Fix (deprecated): from 0.0.0 before 1.2.0.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00266,"percentile":0.18593,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2026-03-04T17:56:18Z","modified":"2026-09-10T03:45:38Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/file_access_fix","fixed_in":["1.2.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/file_access_fix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0"}]}]}],"products":[{"vendor":"drupal","product":"file access fix (deprecated)"},{"vendor":"geeks4change","product":"file_access_fix"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2026-021","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3526"},{"url":"https://github.com/advisories/GHSA-9pv3-cpwf-mpmj"}],"sources":{"cve":[{"id":"CVE-2026-3526","title":"File Access Fix (deprecated) - Moderately critical - Access bypass - SA-CONTRIB-2026-021","description":"Incorrect Authorization vulnerability in Drupal File Access Fix (deprecated) allows Forceful Browsing.This issue affects File Access Fix (deprecated): from 0.0.0 before 1.2.0.","status":"published","published":"2026-03-26T20:02:55.103Z","modified":"2026-03-27T18:17:51.547Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T13:48:58.05327Z"}],"euvd":[{"id":"EUVD-2026-16377","description":"Incorrect Authorization vulnerability in Drupal File Access Fix (deprecated) allows Forceful Browsing.This issue affects File Access Fix (deprecated): from 0.0.0 before 1.2.0.","status":"published","published":"2026-03-26T20:02:55Z","modified":"2026-03-27T18:17:51Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:25:27.277964Z"}],"ghsa":[{"id":"GHSA-9pv3-cpwf-mpmj","title":"Incorrect Authorization vulnerability in Drupal File Access Fix (deprecated) allows Forceful...","description":"Incorrect Authorization vulnerability in Drupal File Access Fix (deprecated) allows Forceful Browsing.This issue affects File Access Fix (deprecated): from 0.0.0 before 1.2.0.","status":"published","published":"2026-03-26T21:31:28Z","modified":"2026-03-27T21:32:39Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:06:54.610516Z"}],"nvd":[{"id":"CVE-2026-3526","description":"Incorrect Authorization vulnerability in Drupal File Access Fix (deprecated) allows Forceful Browsing.This issue affects File Access Fix (deprecated): from 0.0.0 before 1.2.0.","status":"published","published":"2026-03-26T21:17:08.6Z","modified":"2026-06-17T10:43:43.173Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:12:11.678711Z"}],"osv":[{"id":"DRUPAL-CONTRIB-2026-021","description":"This module moves files to and from private storage depending on the access of its owning entities.\n\nThe module does not always validate the access logic correctly, resulting in files attached to an entity not being protected in certain circumstances.\n\nThis vulnerability is mitigated by the fact that saving an entity a second time resolves the issue.","status":"published","published":"2026-03-04T17:56:18Z","modified":"2026-09-10T03:45:38.613326787Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}