Material Icons CVE-2026-3210

Despite the lack of an assigned CVSS score and EPSS probability data, this vulnerability carries moderate to significant real-world risk due to its nature as an authorization bypass. The attack vector appears to be network-based with likely low complexity (simple URL manipulation), and no special privileges are required for exploitation. The fact that no public exploits or POC code have been disclosed suggests the vulnerability is not yet widely exploited, but the ease of exploitation via forceful browsing (low technical bar for attackers) and the straightforward nature of authorization flaws mean opportunistic exploitation is probable. The ENISA EUVD classification (EUVD-2026-15465) confirms this is a tracked vulnerability of concern. Without SSVC data, the primary mitigating factor is that a patch exists (version 2.0.4+), making remediation straightforward for proactive organizations. Organizations running outdated Drupal modules should treat this as a medium-to-high priority based on their exposure.

An attacker could enumerate and access Material Icons module resources by crafting direct URLs to icon endpoints (e.g., /modules/material_icons/icons/[icon-name].svg) without proper authentication or authorization checks. If the module serves sensitive icons or metadata that should be restricted to certain user roles, the attacker bypasses these restrictions through simple HTTP GET requests, discovering all available icons and potentially inferring system configuration or features from the icons' presence. This is a low-complexity, network-based attack requiring no special tools or authentication, though impact is typically information disclosure rather than data manipulation.