Incorrect Authorization Vulnerability in Jsonapi Role Access by Drupal
CVE-2026-84917

Currently unrated

Key Information:

Vendor: Drupal
Status: Jsonapi Role Access
Vendor: CVE Published:; 22 October 2026

What is CVE-2026-84917?

An incorrect authorization vulnerability in the Jsonapi Role Access module for Drupal allows attackers to perform forceful browsing. This risk affects all versions from 0.0.0 to 2.0.2, potentially exposing sensitive information to unauthorized users. Administrators are advised to evaluate their installations and apply necessary updates to mitigate this vulnerability.

Affected Version(s)

Jsonapi Role Access 0.0.0 < 2.0.2

References

https://www.drupal.org/sa-contrib-2026-127

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Oct 22, 2026
Vulnerability Reserved
Sep 2, 2026

Credit

Drew Webber (mcdruid)

Julian Pustkuchen (anybody)

Joshua Sedler (grevil)

Damien McKenna (damienmckenna)

Greg Knaddison (greggles)

Juraj Nemec (poker10)

CVE-2026-84917 Data

JSON