Diff
Monthly
Incorrect Authorization (CWE-863) in the Drupal Diff contributed module allows unauthenticated remote users to perform Forceful Browsing against revision comparison endpoints that should be access-controlled, resulting in limited confidentiality exposure of content diff data. Affected versions span Diff 0.0.0-<2.0.1 and 2.1.0-<2.1.1; a vendor-released patch is available via Drupal Security Advisory SA-Contrib-2026-096. No public exploit code or CISA KEV listing has been identified at time of analysis.
Incorrect Authorization vulnerability in Drupal Diff allows Functionality Misuse.0.0 before 1.8.0. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Incorrect Authorization (CWE-863) in the Drupal Diff contributed module allows unauthenticated remote users to perform Forceful Browsing against revision comparison endpoints that should be access-controlled, resulting in limited confidentiality exposure of content diff data. Affected versions span Diff 0.0.0-<2.0.1 and 2.1.0-<2.1.1; a vendor-released patch is available via Drupal Security Advisory SA-Contrib-2026-096. No public exploit code or CISA KEV listing has been identified at time of analysis.
Incorrect Authorization vulnerability in Drupal Diff allows Functionality Misuse.0.0 before 1.8.0. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.