Jsonapi Role Access CVE-2026-84917

Requires the target Drupal site to have the third-party Jsonapi Role Access contrib module installed and enabled at a version from 0.0.0 up to (but not including) 2.0.2, with Drupal's JSON:API functionality active, since the module's purpose is to gate JSON:API resource access by role. Because CVSS is AV:N/AC:L/PR:N/UI:N, no authentication or user interaction is needed once that module is present, and exploitation works against affected default installs of the module. The principal limiting factor is deployment scope - only sites that have chosen to install this specific contrib module are affected, and impact is bounded to low confidentiality and low integrity (no availability effect); the specific request that triggers the authorization failure is not detailed in the available sources.

This is a moderate-severity authorization flaw, not an urgent one. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated issue, which is why it lands at 6.5; however, impact is capped at C:L/I:L/A:N, so no full data compromise, no integrity destruction, and no availability loss are indicated. The exploitation-probability signals all point low-to-moderate: EPSS is only 0.14% (3rd percentile), there is no CISA KEV listing (not actively exploited), and no public exploit identified at time of analysis. The vuln.today decision label is 'this_month' rather than act_now or emergency, and no SSVC automatable/technical-impact fields were supplied to refine this further. Net: a legitimate patch-worthy authorization bypass that exposes role-restricted JSON:API data, but current evidence indicates targeted/opportunistic rather than widespread exploitation. One caveat: the input Tags label this 'Authentication Bypass' while the CWE-863 classification and 'Forceful Browsing' description make it an authorization (not authentication) flaw - treat it as improper access control over JSON:API resources, not a credential bypass.

An unauthenticated remote attacker directly requests JSON:API resource endpoints on a Drupal site running the Jsonapi Role Access module (version below 2.0.2) and, due to incorrect authorization, retrieves or modifies entity data that should have been restricted to specific roles. No public exploit code has been identified, and the precise request pattern that triggers the bypass is not described in the available sources.