Missing Authorization Vulnerability in Drupal Xray Audit
CVE-2026-96389

Currently unrated

Key Information:

Vendor

Drupal
Status
Xray Audit
Vendor
CVE Published:
30 October 2026

What is CVE-2026-96389?

A missing authorization vulnerability in the Xray Audit component of Drupal allows for forceful browsing, enabling unauthorized users to access restricted resources. This issue directly affects versions from 0.0.0 to 3.1.1, making it crucial for users to update to patched versions to ensure security and prevent unauthorized access.

Affected Version(s)

Xray Audit 0.0.0 < 1.6.3

Xray Audit 2.0.0 < 2.0.4

Xray Audit 3.0.0 < 3.1.1

References

https://www.drupal.org/sa-contrib-2026-206

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

eduardo morales alberti
Hemant Gupta (guptahemant)
Marcus Johansson (marcus_johansson)
Drew Webber (mcdruid)
Luis Ruiz Peidró (lpeidro)
Swan Kalata (akalata)
Greg Knaddison (greggles)
Juraj Nemec (poker10)
.