Drupal Islandora CVE-2026-84916

The affected product is Islandora, a Drupal-based digital-repository/content-management framework (versions 0.0.0 up to the 2.19.0 fix). The flaw is a missing authorization check (CWE-862) that permits forceful browsing: an attacker can reach protected resources by requesting their paths directly. The vector is unauthenticated and network-reachable (PR:N/AV:N/UI:N), so no login or user interaction is required. Limiting factors: impact is confined to low-severity confidentiality disclosure (C:L; no integrity or availability impact), the instance must be network-accessible and running Islandora at or below the affected version, and the attacker must know or enumerate the protected resource paths. The precise trigger (which specific endpoints or object states bypass the check) is not described in the available sources.

All decision signals converge on low priority. The input CVSS is 3.7 (Low) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - network reachable and unauthenticated (PR:N) but limited to low confidentiality impact only, with no integrity or availability effect. EPSS is 0.14% (3rd percentile), indicating very low statistical likelihood of exploitation. The vuln.today decision label is 'monitor', and SSVC reports Exploitation: none, Automatable: no, Technical Impact: partial - all consistent with a non-urgent issue. There is no KEV listing (no public exploit identified at time of analysis) and no PoC reference beyond the vendor advisory. The one notable tension is that the input vector asserts AC:H, yet the weakness class (CWE-862 Missing Authorization / forceful browsing) and the description do not explain what makes the trigger high-complexity; the mechanism is not described in the available sources, so the AC:H rating cannot be corroborated. Net: this is a genuinely low-risk disclosure - information exposure via authorization bypass - not a high-CVSS-but-overstated issue, and the main action is routine patching.

A remote, unauthenticated attacker directly requests Islandora repository resources (objects, media, or node paths) that should be protected, and because an authorization check is missing the server returns them, disclosing content the user should not be able to view. Impact is confined to low-severity confidentiality exposure (C:L), with no modification or disruption. No public exploit code is identified; the only published artifact is the vendor security advisory.