PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-84917 Drupal CVE debrief

CVE-2026-84917 is an Incorrect Authorization vulnerability in Drupal Jsonapi Role Access that allows Forceful Browsing. The issue affects Jsonapi Role Access versions from 0.0.0 to 2.0.2. Defenders should assess exposure and apply patches. Verify and update access controls to prevent unauthorized access. Monitor for potential Forceful Browsing attempts to detect possible exploitation. Prioritize patching Jsonapi Role Access versions prior to 2.0.2 to prevent exploitation. This vulnerability has a high impact on Drupal administrators and security teams.

Vendor
Drupal
Product
Jsonapi Role Access
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-22
Original CVE updated
2026-10-22
Advisory published
2026-10-22
Advisory updated
2026-10-22

Who should care

Drupal administrators and security teams should assess exposure and apply patches for Jsonapi Role Access versions prior to 2.0.2. They should also review and update access controls for Jsonapi Role Access and monitor for potential Forceful Browsing attempts. Additionally, they should prioritize patching Jsonapi Role Access versions prior to 2.0.2 to prevent exploitation.

Why it matters

CVE-2026-84917 is an Incorrect Authorization vulnerability in Drupal Jsonapi Role Access that allows Forceful Browsing, affecting versions from 0.0.0 to 2.0.2. Defenders should prioritize verifying exposure and applying patches.

  • Verify and update access controls to prevent unauthorized access
  • Monitor for potential Forceful Browsing attempts to detect possible exploitation
  • Prioritize patching Jsonapi Role Access versions prior to 2.0.2 to prevent exploitation

Technical summary

The Jsonapi Role Access module for Drupal has an Incorrect Authorization vulnerability, allowing Forceful Browsing. This issue affects versions from 0.0.0 to 2.0.2. The vulnerability is caused by incorrect authorization checks in the module. Attackers can exploit this vulnerability to bypass access controls and gain unauthorized access to sensitive data. To prevent exploitation, defenders should prioritize verifying exposure and applying patches for Jsonapi Role Access versions prior to 2.0.2.

Defensive priority

Defenders should prioritize verifying exposure and applying patches for Jsonapi Role Access versions prior to 2.0.2.

Recommended defensive actions

  • Verify Jsonapi Role Access version and upgrade to 2.0.2 or later if necessary
  • Review and update access controls for Jsonapi Role Access
  • Monitor for potential Forceful Browsing attempts

Evidence notes

The CVE record and source item provide details on the vulnerability and affected versions. However, additional information on exploitation or impact is limited.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-84917 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-84917

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-84917 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-84917

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.