CVE-2026-96389: Xray Audit - Moderately critical - Access bypass - SA-CONTRIB-2026-206

Published Oct 30, 2026

Updated

Missing Authorization vulnerability in Drupal Xray Audit allows Forceful Browsing. This issue affects Xray Audit versions: from 0.0.0 to 1.6.3, from 2.0.0 to 2.0.4, from 3.0.0 to 3.1.1.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Drupal Xray Audit to a version that resolves this vulnerability.
Patch SA-CONTRIB-2026-206

Event History

Oct 30, 2026

CVE Published

via MITRE·03:10 AM

Data Sourced

via MITRE·03:10 AM

DescriptionWeakness

Data Sourced

via NVD·04:18 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Drupal sites using Xray Audit versions 0.0.0 through 1.6.3, 2.0.0 through 2.0.4, or 3.0.0 through 3.1.1 are affected.

Does exploitation require an authenticated account or user interaction?

No. The vulnerability is rated AV:N/AC:L/PR:N/UI:N, indicating it can be exploited remotely with low complexity, without privileges or user interaction.

What security impact can successful exploitation have?

Successful forceful browsing can bypass authorization controls and has low confidentiality and integrity impact. No availability impact is indicated.

CVE-2026-96389: Xray Audit - Moderately critical - Access bypass - SA-CONTRIB-2026-206

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

Does exploitation require an authenticated account or user interaction?

What security impact can successful exploitation have?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

Does exploitation require an authenticated account or user interaction?

What security impact can successful exploitation have?