Project:
Project machine name:
xray_auditDate:
2026-October-07
Vulnerability:
Access bypass
Affected versions:
<1.6.3 || >=2.0.0 <2.0.4 || >=3.0.0 <3.1.1
CVE IDs:
CVE-2026-96389
Description:
This module enables you to audit a Drupal site by generating reports about its content, entities, display modes and configuration.
The module doesn't sufficiently check entity access when rendering an entity through the display-mode example route. This allows an attacker to view unpublished or otherwise access-restricted content.
This vulnerability is mitigated by the fact that field-level access is still enforced, so fields that are themselves access-restricted (for example a user's email or password hash) are not disclosed.
Solution:
Install the latest versions:
- If you use the X-ray Audit version 3.1.x, upgrade to X-ray Audit 3.1.1.
- If you use the X-ray Audit version 2.0.x, upgrade to X-ray Audit 2.0.4.
- If you use the X-ray Audit version 1.6.x, upgrade to X-ray Audit 1.6.3.
Reported By:
- eduardo morales alberti
- Hemant Gupta (guptahemant)
- Marcus Johansson (marcus_johansson)
- Drew Webber (mcdruid) of the Drupal Security Team
Fixed By:
Coordinated By:
- Swan Kalata (akalata) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
