Privilege Escalation Vulnerability in Drupal Role Delegation
CVE-2026-0945

5.4MEDIUM

Key Information:

Vendor

Drupal
Status
Role Delegation
Vendor
CVE Published:
4 February 2026

What is CVE-2026-0945?

A vulnerability exists in the Role Delegation module of Drupal that permits unauthorized privilege escalation. This flaw allows users with lesser privileges to carry out actions reserved for higher-level roles. Specifically, versions 1.3.0 through 1.4.0 are affected, making it essential for administrators to update to version 1.5.0 or later to mitigate potential security risks. For further details, please refer to the official advisory.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Role Delegation 1.3.0 < 1.5.0

References

https://www.drupal.org/sa-contrib-2026-002

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Drew Webber (mcdruid)
Adam Bramley (acbramley)
Dieter Holvoet (dieterholvoet)
Greg Knaddison (greggles)
Drew Webber (mcdruid)
Juraj Nemec (poker10)
JSON
.