SA-CONTRIB-2026-127: Critical severity drupal/jsonapi_role_access vulnerability
Published Sep 2, 2026
·Updated
This module enables you to restrict access to JSON:API routes based on specific user roles. The module doesn't sufficiently enforce access controls under scenarios where a request mimics an XMLHttpRequest.
Credit
Drew Webber (mcdruid)(the Drupal Security Team)
Affected Software
1 affected componentFixes available
drupal/jsonapi_role_access<2.0.2
2.0.2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/jsonapi_role_accessto a version that resolves this vulnerability.Fixed in 2.0.2
Event History
Sep 2, 2026
Advisory Published
via Drupal·12:00 AM
Data Sourced
via Drupal·12:00 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Which deployments are exposed?
Drupal sites using the jsonapi_role_access module to restrict access to JSON:API routes based on user roles are affected by the insufficient access-control enforcement described.
2
What does an attacker need to do to trigger the access-control issue?
The request must mimic an XMLHttpRequest. Under that scenario, the module may not sufficiently enforce the configured access controls for JSON:API routes.