Drupal Xray Audit CVE-2026-96389

Exploitation requires that the Drupal Xray Audit contrib module be installed and enabled on a network-reachable Drupal site at an affected version (0.0.0-1.6.3, 2.0.0-2.0.4, or 3.0.0-3.1.1); the flaw is reachable without authentication, privileges, or user interaction (PR:N/UI:N), so no special configuration toggle is cited in the advisory. The primary limiting factor is deployment scope: Xray Audit is an optional contrib auditing module, so only sites that have specifically installed it are exposed - this is not a default-Drupal condition. The exact protected routes affected and whether exploitation yields only data disclosure or also triggers audit actions are not described in the available sources.

This is a moderate-severity, low-urgency issue that should be patched on a normal cycle rather than as an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates a network-reachable flaw requiring no privileges or user interaction, which maps consistently to CWE-862 Missing Authorization / Forceful Browsing - an unauthorized party reaching resources that should be access-controlled. However, the impact is bounded (C:L/I:L/A:N, scope unchanged), yielding a 6.5 base score rather than a critical rating. The exploitation signals agree with this low-priority reading and do not conflict: EPSS is 0.13% (3rd percentile, very low), the CVE is NOT on CISA KEV, and SSVC records Exploitation: none. The only elevating signal is SSVC Automatable: yes, which is expected for a no-auth forceful-browsing bug that can be scripted, but 'Automatable' describes ease of scaling IF exploitation occurs, not that it is occurring. The vuln.today decision label is 'this_month', consistent with 'patch in a normal maintenance window.' No key signals are missing except a verified working exploit; the two references are the Drupal security advisory and the NVD mirror, not published exploit code. Net: a real but non-urgent authorization gap in a Drupal contrib module, not a high-CVSS-but-illusory issue, yet also not an active-exploitation emergency.

An unauthenticated remote attacker directly requests (forcefully browses to) the Xray Audit module's URLs/routes on a Drupal site, bypassing the missing authorization check to view audit output or invoke audit functionality intended only for privileged users. Because no authentication, privileges, or user interaction are required, the request can be scripted and repeated across many sites. No public exploit identified at time of analysis; the trigger mechanics beyond 'forceful browsing to protected routes' are not described in the available sources.