SA-CONTRIB-2026-185: Critical severity drupal/editoria11y vulnerability
This module runs a client-side accessibility checker that automatically reports results to dashboard views over an API. The module incorrectly described a permission as a "view" permission when it grants edit and delete access to module data, resulting in a potential access bypass.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/editoria11yto a version that resolves this vulnerability.Fixed in 2.2.23Fixed in 3.0.9
Event History
Frequently Asked Questions
Which deployments should be prioritized for review?
Review deployments where a role has been granted the module permission described as a view permission. That permission may provide edit and delete access to module data.
What would an attacker need to exploit this issue?
An attacker would need an account assigned the misleadingly described permission. The issue arises because that permission can grant edit and delete capabilities rather than view-only access.
How can administrators check for exposure?
Review role and user permission assignments for the module permission labeled as view access, and identify accounts that should not be able to edit or delete module data.