EUVD-2026-107816
GHSA-jp5c-5h2g-6r96
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege Drupal user
-
ExploitInvoke permission-gated Editoria11y action
-
ImpactEscalate effective privileges within site
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V8 - Authorization Privilege defined with unsafe actions
|
| Exploitation Conditions | Exploitation requires an authenticated Drupal account that has been granted the Editoria11y Accessibility Checker permission which is defined with unsafe actions (CWE-267); the CVSS PR:L confirms a privileged/authenticated prerequisite. The limiting factors are substantial: the attacker must already possess a site account AND that account must hold the specific module permission, and the site must run an affected version (≤2.2.23 or 3.0.0-3.0.9) with the Editoria11y module installed and enabled. No user interaction is required (UI:N), and impact is confined to integrity (I:L) with no confidentiality or availability effect. The precise unsafe action reachable via the permission is not described in the available sources. |
| Impact | This is a medium-severity, low-priority issue rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N = 4.3) indicates a network-reachable flaw that requires an already-authenticated Drupal account (PR:L) and yields only limited integrity impact (I:L) with no confidentiality or availability loss. EPSS is very low at 0.13% (3rd percentile), and the vulnerability is NOT in CISA KEV, so there is no public exploit identified at time of analysis - the signals are internally consistent: low exploitation probability, no active-exploitation evidence, and a modest technical impact. The vuln.today decision label is 'this_month', which aligns with a patch-on-normal-cycle posture rather than act_now/emergency. CWE-267 (Privilege Defined With Unsafe Actions) means the module defines a Drupal permission that grants access to actions more powerful than intended, allowing a user holding that permission to escalate privileges; the exact unsafe action is not detailed in the available sources. No signals conflict here - this is a genuine but low-urgency privilege-escalation hardening fix, not a high-CVSS-but-overhyped issue. |
| Exploit ScenarioDerived | An authenticated Drupal user who has been granted the Editoria11y-related permission uses the overly-broad permission to perform actions beyond their intended privilege level, escalating their effective access within the site. No public exploit code or PoC reference is provided, and the precise unsafe action is not described in the available sources. Exploitation requires an existing low-privilege account that already holds the affected permission. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 22, 2026
Privilege escalation in the Drupal contributed module Editoria11y Accessibility Checker lets an account that already holds the module-granted permission perform actions beyond what that permission should allow, affecting integrity only. Sites running any release from 0.0.0 through 2.2.23 or from 3.0.0 through 3.0.9 with the module installed and enabled are exposed, but the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) confirms the attacker must first hold an authenticated account carrying that specific permission. Exploitation is not confirmed as active - the issue is not in CISA KEV, no public exploit code is identified at time of analysis, and EPSS is only 0.13% (3rd percentile), which matches the this_month, medium-severity, low-priority rating rather than an emergency.
RemediationAI
Patch availability is confirmed from the vendor: Drupal published SA-CONTRIB-2026-185 (https://www.drupal.org/sa-contrib-2026-185), and the affected ranges given as 0.0.0 through 2.2.23 and 3.0.0 through 3.0.9 indicate a fix in each branch - confirm the exact fixed release in the advisory before upgrading, then update the module via Composer or the Drupal admin UI and run the database update routine. Because the prerequisite is an account holding the module's permission, the interim reduction in exposure is to audit roles and remove the Editoria11y permission from accounts that do not need it; the trade-off is that those users lose access to the accessibility checker's features on the site. No other compensating control is described in the available sources, and reconnaissance for the module's presence is cheap, so the exposure of an unpatched, enabled install remains until the update is applied.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-267, Privilege Defined With Unsafe Actions: a permission or role shipped by the Editoria11y module is configured such that the actions it authorizes exceed the trust level the permission is meant to convey, so a holder can escalate to something more powerful than intended. The CPE cpe:2.3:a:drupal:editoria11y_accessibility_checker:*:*:*:*:*:*:*:* covers the whole product rather than a single release, which is why both maintained branches are in scope. The flaw sits in Drupal's contributed-module permission model rather than in core, so the attack surface exists only where the module is enabled and a role has been granted its Editoria11y permission; the network vector and PR:L reflect that a valid account with that grant is the entry condition, UI:N means no victim action is needed, and the unchanged scope with I:L means the consequence is bounded to unintended modifications. The specific unsafe action reachable through the permission, and the exact code path that enforces it, are not described in the available sources.
Know when Editoria11Y Accessibility Checker gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Reachable over the web (AV:N) but requires an authenticated account holding the module permission (PR:L); limited integrity-only impact (I:L) with no confidentiality or availability loss.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
4DescriptionCVE.org
Privilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Accessibility Checker allows Privilege Escalation. This issue affects Editoria11y Accessibility Checker versions: from 0.0.0 to 2.2.23, from 3.0.0 to 3.0.9.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB