Drupal Diff CVE-2026-73478

The Drupal Diff contributed module must be installed and enabled on the target site - it is not part of Drupal core, so sites that have never installed it are unaffected. Meaningful confidentiality impact requires that at least some content on the site is access-restricted at the node or content-type level (e.g., unpublished drafts, members-only content); sites where all content is fully public experience no additional exposure. No authentication, special configuration, or non-default setting is required for exploitation: PR:N and AC:L in the CVSS vector confirm that any network-reachable instance running an affected version is exploitable. Exploitation is limited to read-only access to revision diff data; no write, delete, or privilege-escalation capability is exposed by this flaw.

The Medium CVSS score of 5.3 accurately reflects a bounded real-world risk: the flaw leaks revision diff content but confers no write or administrative capability (I:N, A:N), and scope is unchanged (S:U), so lateral movement or privilege escalation is not directly enabled by this vulnerability alone. The unauthenticated network attack vector (AV:N/AC:L/PR:N/UI:N) means any internet-facing Drupal instance running the affected module is reachable without credentials, which is the meaningful risk factor for sites that host access-restricted or draft content. EPSS data was not included in the provided intelligence, so probabilistic exploitation frequency cannot be quantified. No public exploit code has been published and the vulnerability is not listed in CISA KEV, indicating opportunistic scanning has not yet emerged as a significant threat. The practical impact depends entirely on the sensitivity of the content managed in the affected Drupal instance - a site hosting only fully public content gains no additional exposure, while a site with embargoed drafts or confidential editorial revisions should treat this as a genuine disclosure risk and apply the vendor patch without delay.

An unauthenticated attacker discovers a Drupal site running the affected Diff module by observing diff-related HTML or JavaScript artifacts in page source. The attacker constructs or enumerates node revision comparison URLs (e.g., /node/42/revisions/view/100/101/split) and issues direct HTTP GET requests; because the module omits the access check, the server responds with the full diff of those revisions regardless of the node's access restrictions. No exploit tooling or authentication is required beyond a standard HTTP client.