What is the CVSS score of CVE-2026-3527?

CVE-2026-3527 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Ajax Dashboard are affected by CVE-2026-3527?

CVE-2026-3527 presents notable security risk, a missing authentication vulnerability rated CVSS 6.5. This could allow unauthorized access to protected resources.. A patch is available.

How to fix or mitigate CVE-2026-3527?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Audit authentication configurations.

Ajax Dashboard CVE-2026-3527

EUVD-2026-16379 MEDIUM

Missing Authentication for Critical Function (CWE-306)

2026-03-26 drupal

Authentication Bypass Ajax Dashboard

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 26, 2026 - 20:31 euvd

EUVD-2026-16379

Analysis Generated

Mar 26, 2026 - 20:31 vuln.today

CVE Published

Mar 26, 2026 - 20:03 nvd

MEDIUM 6.5

DescriptionCVE.org

Missing Authentication for Critical Function vulnerability in Drupal AJAX Dashboard allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AJAX Dashboard: from 0.0.0 before 3.1.0.

AnalysisAI

Drupal AJAX Dashboard versions before 3.1.0 fail to enforce authentication on critical AJAX endpoints, allowing unauthenticated remote attackers to bypass access controls and invoke privileged dashboard functions. The vulnerability affects all versions from 0.0.0 through 3.1.0 (exclusive) and is categorized as a Missing Authentication for Critical Function (CWE-306). No public exploit code or active exploitation via CISA KEV has been confirmed at time of analysis, but the authentication bypass nature of this defect presents significant risk to installations relying on dashboard security.

Technical ContextAI

The AJAX Dashboard module for Drupal (CPE: cpe:2.3:a:drupal:ajax_dashboard:*:*:*:*:*:*:*:*) implements AJAX-based endpoints for dashboard operations without properly validating user authentication state before processing requests. The root cause is classified as CWE-306 (Missing Authentication for Critical Function), a class of vulnerability where security-critical operations are accessible without credential verification. AJAX endpoints typically handle asynchronous data retrieval and state modification; when these endpoints lack authentication checks, attackers can craft HTTP requests directly to invoke protected actions. The vulnerability stems from improper access control configuration in the module's routing or permission system, allowing the module to process requests from unauthenticated sessions.

RemediationAI

Upgrade Drupal AJAX Dashboard to version 3.1.0 or later as indicated in the vendor security advisory at https://www.drupal.org/sa-contrib-2026-022. This patch release fixes the missing authentication control on critical AJAX endpoints. Until patching is completed, administrators should disable or restrict access to the AJAX Dashboard module via web server configuration (e.g., Apache/.htaccess or nginx location blocks) to limit exposure to sensitive endpoints. Additionally, implement network-level access controls to restrict dashboard access to trusted IP ranges and apply Drupal's standard permission model to further minimize risk. Monitor Drupal logs for suspicious AJAX requests to dashboards endpoints as a temporary detection measure.