{"id":"CVE-2026-96390","aliases":["DRUPAL-CONTRIB-2026-185","EUVD-2026-107816","GHSA-jp5c-5h2g-6r96"],"status":"published","title":"Editoria11y Accessibility Checker - Moderately critical - Access bypass - SA-CONTRIB-2026-185","description":"Privilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Accessibility Checker allows Privilege Escalation. This issue affects Editoria11y Accessibility Checker versions: from 0.0.0 to 2.2.23, from 3.0.0 to 3.0.9.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00209,"percentile":0.11211,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-267"],"published":"2026-09-23T17:18:31Z","modified":"2026-10-28T02:30:54Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/editoria11y","fixed_in":["2.2.23","3.0.9"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/editoria11y","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.23"}]},{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.9"}]}]}],"products":[{"vendor":"drupal","product":"editoria11y accessibility checker"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2026-185","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96390","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jp5c-5h2g-6r96"},{"url":"https://git.drupalcode.org/project/editoria11y","tags":["web"]},{"url":"https://www.drupal.org/project/editoria11y","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/96xxx/CVE-2026-96390.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-96390","title":"Editoria11y Accessibility Checker - Moderately critical - Access bypass - SA-CONTRIB-2026-185","description":"Privilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Accessibility Checker allows Privilege Escalation. This issue affects Editoria11y Accessibility Checker versions: from 0.0.0 to 2.2.23, from 3.0.0 to 3.0.9.","status":"published","published":"2026-10-22T01:21:22.64Z","modified":"2026-10-22T14:48:21.663Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-267"],"updated_at":"2026-11-02T14:20:00.511569Z"}],"euvd":[{"id":"EUVD-2026-107816","description":"Privilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Accessibility Checker allows Privilege Escalation. This issue affects Editoria11y Accessibility Checker versions: from 0.0.0 to 2.2.23, from 3.0.0 to 3.0.9.","status":"published","published":"2026-10-22T01:21:22Z","modified":"2026-10-22T14:48:21Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:59:35.198677Z"}],"ghsa":[{"id":"GHSA-jp5c-5h2g-6r96","title":"Privilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Accessibility Checker...","description":"Privilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Accessibility Checker allows Privilege Escalation. This issue affects Editoria11y Accessibility Checker versions: from 0.0.0 to 2.2.23, from 3.0.0 to 3.0.9.","status":"published","published":"2026-10-22T03:33:48Z","modified":"2026-10-22T15:33:48Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-267"],"updated_at":"2026-11-02T15:14:16.352322Z"}],"nvd":[{"id":"CVE-2026-96390","description":"Privilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Accessibility Checker allows Privilege Escalation. This issue affects Editoria11y Accessibility Checker versions: from 0.0.0 to 2.2.23, from 3.0.0 to 3.0.9.","status":"published","published":"2026-10-22T02:17:09.237Z","modified":"2026-10-22T16:54:17.39Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-267"],"updated_at":"2026-11-02T14:13:02.371082Z"}],"osv":[{"id":"CVE-2026-96390","title":"Editoria11y Accessibility Checker - Moderately critical - Access bypass - SA-CONTRIB-2026-185","description":"Privilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Accessibility Checker allows Privilege Escalation. This issue affects Editoria11y Accessibility Checker versions: from 0.0.0 to 2.2.23, from 3.0.0 to 3.0.9.","status":"published","published":"2026-10-22T01:21:22.64Z","modified":"2026-10-28T02:30:54.524569719Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-267"],"updated_at":"2026-11-02T15:45:21.262447Z"},{"id":"DRUPAL-CONTRIB-2026-185","description":"This module runs a client-side accessibility checker that automatically reports results to dashboard views over an API.\n\nThe module incorrectly described a permission as a \"view\" permission when it grants edit and delete access to module data, resulting in a potential access bypass.","status":"published","published":"2026-09-23T17:18:31Z","modified":"2026-09-23T19:15:05.310550211Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}