Project: 
Material Icons
Date: 
2026-February-25
Security risk: 
Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All
Vulnerability: 
Access bypass
Affected versions: 
<2.0.4
CVE IDs: 
CVE-2026-3210
Description: 

This module enables you to add icons to CKEditor.

The module doesn't sufficiently add custom permissions to the dialog and autocomplete routes, allowing full access to the routes in most scenarios.

Solution: 

Install the latest version and review permissions:

  1. If you use the Material Icons module for Drupal, upgrade to Material Icons 2.0.4.
  2. Assign the newly created "use material icons" permission to users who should have access to the widgets.
Reported By: 
Fixed By: 
Coordinated By: