PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-73478 Diff Project CVE debrief

CVE-2026-73478 is an Incorrect Authorization vulnerability in Drupal Diff that allows Forceful Browsing. The issue affects Diff versions from 0.0.0 to 2.0.1 and from 2.1.0 to 2.1.1. According to the CVE Program and NVD, this vulnerability has a CVSS score of 5.3 and a severity of MEDIUM. Defenders should prioritize verifying exposure in their Drupal installations using the affected Diff versions and applying patches or updates as recommended by the vendor. This vulnerability could allow attackers to access unauthorized information or perform actions within the affected Drupal installations.

Vendor
Diff Project
Product
Diff
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-02
Original CVE updated
2026-09-16
Advisory published
2026-09-02
Advisory updated
2026-09-16

Who should care

Drupal administrators and security teams should assess exposure and apply patches or updates as recommended by the vendor. They should verify if their Drupal installation uses an affected version of the Diff module and monitor their Drupal installation for potential exploitation attempts.

Why it matters

CVE-2026-73478 is an Incorrect Authorization vulnerability in Drupal Diff that allows Forceful Browsing. Defenders should prioritize verifying exposure in their Drupal installations using the affected Diff versions and applying patches or updates as recommended by the vendor.

  • Verify if your Drupal installation uses an affected version of the Diff module.
  • Apply patches or updates recommended by the vendor.
  • Monitor your Drupal installation for potential exploitation attempts.

Technical summary

The Incorrect Authorization vulnerability in Drupal Diff allows Forceful Browsing. The issue affects Diff versions from 0.0.0 to 2.0.1 and from 2.1.0 to 2.1.1. The CVSS score is 5.3, and the severity is MEDIUM. This vulnerability could allow attackers to access unauthorized information or perform actions within the affected Drupal installations. The CVE Program and NVD provide official records of the vulnerability, including its description, CVSS score, and affected versions.

Defensive priority

Defenders should prioritize verifying exposure in their Drupal installations using the affected Diff versions and applying patches or updates as recommended by the vendor.

Recommended defensive actions

  • Verify if your Drupal installation uses an affected version of the Diff module.
  • Apply patches or updates recommended by the vendor.
  • Monitor your Drupal installation for potential exploitation attempts.

Evidence notes

The CVE Program and NVD provide official records of the vulnerability, including its description, CVSS score, and affected versions. A vendor advisory is also available.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-73478 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-73478

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-73478 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-73478

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.