CVE-2026-84917: Jsonapi Role Access - Critical - Access bypass - SA-CONTRIB-2026-127

Q: Which installations are affected?

Drupal sites using Jsonapi Role Access versions from 0.0.0 through 2.0.2 are affected.

Q: What access does an attacker need to exploit this issue?

The issue is an authorization bypass through forceful browsing. The provided information does not specify whether authentication or any particular role is required.

Published Oct 22, 2026

Updated

Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This issue affects Jsonapi Role Access versions: from 0.0.0 to 2.0.2.

Affected Software

1 affected component

Drupal Jsonapi Role Access>=0.0.0<=2.0.2

Event History

Oct 22, 2026

CVE Published

via MITRE·01:22 AM

Data Sourced

via MITRE·01:22 AM

DescriptionWeakness

Frequently Asked Questions

Which installations are affected?

Drupal sites using Jsonapi Role Access versions from 0.0.0 through 2.0.2 are affected.

What access does an attacker need to exploit this issue?

The issue is an authorization bypass through forceful browsing. The provided information does not specify whether authentication or any particular role is required.

CVE-2026-84917: Jsonapi Role Access - Critical - Access bypass - SA-CONTRIB-2026-127

Affected Software

Event History

Frequently Asked Questions

Which installations are affected?

What access does an attacker need to exploit this issue?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

What access does an attacker need to exploit this issue?