Jsonapi Role Access
Monthly
Unauthenticated forceful browsing in the Drupal contrib module Jsonapi Role Access allows remote attackers to reach JSON:API resources that the module is supposed to restrict by role, with low confidentiality and low integrity impact and no availability effect. Sites are affected only if they run this specific contrib module at a version below the fixed release and have Drupal's JSON:API functionality active; the CVSS vector (AV:N/AC:L/PR:N/UI:N) means no credentials or user interaction are needed once the module is present. Severity is moderate (6.5) and urgency is limited: EPSS is 0.14% (3rd percentile), there is no KEV entry, and no public exploit identified at time of analysis; a vendor patch is available and the priority label is this_month.
Unauthenticated forceful browsing in the Drupal contrib module Jsonapi Role Access allows remote attackers to reach JSON:API resources that the module is supposed to restrict by role, with low confidentiality and low integrity impact and no availability effect. Sites are affected only if they run this specific contrib module at a version below the fixed release and have Drupal's JSON:API functionality active; the CVSS vector (AV:N/AC:L/PR:N/UI:N) means no credentials or user interaction are needed once the module is present. Severity is moderate (6.5) and urgency is limited: EPSS is 0.14% (3rd percentile), there is no KEV entry, and no public exploit identified at time of analysis; a vendor patch is available and the priority label is this_month.