CVE-2026-73478: Diff - Moderately critical - Access bypass - SA-CONTRIB-2026-096

Q: Which Diff installations are affected?

Affected versions are 0.0.0 through 2.0.1 and 2.1.0 through 2.1.1. The supplied information does not identify a fixed version.

Q: Can this be exploited remotely without an account?

Yes. The CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.

Q: What is the expected impact?

The vulnerability is an authorization bypass through forceful browsing and has a confidentiality impact rated Low. Integrity and availability impacts are rated None.

Published Sep 2, 2026

Updated

Incorrect Authorization vulnerability in Drupal Diff allows Forceful Browsing. This issue affects Diff versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1.

Affected Software

8 affected components

Drupal Drupal Diff>=0.0.0<=2.0.1, >=2.1.0<=2.1.1

Diff Project Diff Drupal<2.0.1

Diff Project Diff Drupal>=5.x-1.0<=5.x-2.1

Diff Project Diff Drupal>=6.x-1.0<=6.x-2.3

Diff Project Diff Drupal>=7.x-3.0<=7.x-3.5

Diff Project Diff Drupal>=8.x-1.0<=8.x-1.10

Diff Project Diff Drupal=2.1.0

Diff Project Diff Drupal=4.7.x-1.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade drupal/diff to a version that resolves this vulnerability.
Fixed in 2.0.1
Upgrade
Upgrade drupal/diff to a version that resolves this vulnerability.
Fixed in 2.1.1

Event History

Sep 2, 2026

CVE Published

via MITRE·12:32 PM

Data Sourced

via MITRE·12:32 PM

DescriptionWeakness

Data Sourced

via NVD·01:18 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Which Diff installations are affected?

Affected versions are 0.0.0 through 2.0.1 and 2.1.0 through 2.1.1. The supplied information does not identify a fixed version.

Can this be exploited remotely without an account?