Editoria11Y Accessibility Checker
Monthly
Privilege escalation in the Drupal contributed module Editoria11y Accessibility Checker lets an account that already holds the module-granted permission perform actions beyond what that permission should allow, affecting integrity only. Sites running any release from 0.0.0 through 2.2.23 or from 3.0.0 through 3.0.9 with the module installed and enabled are exposed, but the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) confirms the attacker must first hold an authenticated account carrying that specific permission. Exploitation is not confirmed as active - the issue is not in CISA KEV, no public exploit code is identified at time of analysis, and EPSS is only 0.13% (3rd percentile), which matches the this_month, medium-severity, low-priority rating rather than an emergency.
Privilege escalation in the Drupal contributed module Editoria11y Accessibility Checker lets an account that already holds the module-granted permission perform actions beyond what that permission should allow, affecting integrity only. Sites running any release from 0.0.0 through 2.2.23 or from 3.0.0 through 3.0.9 with the module installed and enabled are exposed, but the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) confirms the attacker must first hold an authenticated account carrying that specific permission. Exploitation is not confirmed as active - the issue is not in CISA KEV, no public exploit code is identified at time of analysis, and EPSS is only 0.13% (3rd percentile), which matches the this_month, medium-severity, low-priority rating rather than an emergency.