Xray Audit
Monthly
Missing authorization in the Drupal Xray Audit contrib module allows unauthenticated remote visitors to reach protected routes directly, a forceful-browsing condition affecting the 1.x branch through 1.6.3, the 2.x branch through 2.0.4, and the 3.x branch through 3.1.1. Only Drupal sites that have installed and enabled this optional auditing module are exposed, so deployment scope is narrow; the advisory rates the issue CVSS 3.1 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), with limited confidentiality and integrity impact and no availability impact. No public exploit code has been identified at the time of analysis (EPSS 0.13%, 3rd percentile), CISA SSVC records exploitation as none, and a vendor patch is available, so this is prioritised for patching this month rather than as an emergency.
Missing authorization in the Drupal Xray Audit contrib module allows unauthenticated remote visitors to reach protected routes directly, a forceful-browsing condition affecting the 1.x branch through 1.6.3, the 2.x branch through 2.0.4, and the 3.x branch through 3.1.1. Only Drupal sites that have installed and enabled this optional auditing module are exposed, so deployment scope is narrow; the advisory rates the issue CVSS 3.1 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), with limited confidentiality and integrity impact and no availability impact. No public exploit code has been identified at the time of analysis (EPSS 0.13%, 3rd percentile), CISA SSVC records exploitation as none, and a vendor patch is available, so this is prioritised for patching this month rather than as an emergency.