Project:
Project machine name:
dkanDate:
2026-October-07
Security risk:
Vulnerability:
Access bypass
Affected versions:
<4.0.4 || >=4.1.0 <4.1.5
CVE IDs:
CVE-2026-107267
Description:
The DKAN module enables organizations and individuals to build open data portals in Drupal. The DKAN datastore imports tabular data files into database tables and exposes them for querying with a JSON API.
The module does not correctly check access for all of its endpoints, leading to a potential access bypass.
The vulnerability is mitigated by the fact that it is only impactful for sites that do not give "access content" permission to the anonymous role.
Solution:
Install the latest version:
- If you use DKAN 4.1.x, upgrade to DKAN 4.1.5
- If you use DKAN 4.0.x, upgrade to DKAN 4.0.4
Reported By:
Coordinated By:
- Swan Kalata (akalata) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
