CVE-2026-73478: Diff - Moderately critical - Access bypass - SA-CONTRIB-2026-096

Q: Which Diff installations are affected?

Affected versions are 0.0.0 through 2.0.1 and 2.1.0 through 2.1.1. The supplied information does not identify a fixed version.

Q: Can this be exploited remotely without an account?

Yes. The CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.

Q: What is the expected impact?

The vulnerability is an authorization bypass through forceful browsing and has a confidentiality impact rated Low. Integrity and availability impacts are rated None.

Published Sep 2, 2026

Updated

Incorrect Authorization vulnerability in Drupal Diff allows Forceful Browsing. This issue affects Diff versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1.

Affected Software

1 affected component

Drupal Drupal Diff>=0.0.0<=2.0.1, >=2.1.0<=2.1.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade drupal/diff to a version that resolves this vulnerability.
Fixed in 2.0.1
Upgrade
Upgrade drupal/diff to a version that resolves this vulnerability.
Fixed in 2.1.1

Event History

Sep 2, 2026

CVE Published

via MITRE·12:32 PM

Data Sourced

via MITRE·12:32 PM

DescriptionWeakness

Data Sourced

via NVD·01:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which Diff installations are affected?

Affected versions are 0.0.0 through 2.0.1 and 2.1.0 through 2.1.1. The supplied information does not identify a fixed version.

Can this be exploited remotely without an account?

Yes. The CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.

What is the expected impact?

The vulnerability is an authorization bypass through forceful browsing and has a confidentiality impact rated Low. Integrity and availability impacts are rated None.

CVE-2026-73478: Diff - Moderately critical - Access bypass - SA-CONTRIB-2026-096

Affected Software

Remediation

Event History

Frequently Asked Questions

Which Diff installations are affected?

Can this be exploited remotely without an account?

What is the expected impact?

Company

Resources

Contact

Frequently Asked Questions

Which Diff installations are affected?

Can this be exploited remotely without an account?

What is the expected impact?