{"id":"CVE-2026-96390","summary":"Editoria11y Accessibility Checker - Moderately critical - Access bypass - SA-CONTRIB-2026-185","details":"Privilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Accessibility Checker allows Privilege Escalation. This issue affects Editoria11y Accessibility Checker versions: from 0.0.0 to 2.2.23, from 3.0.0 to 3.0.9.","aliases":["DRUPAL-CONTRIB-2026-185"],"modified":"2026-10-23T02:46:13.226793573Z","published":"2026-10-22T01:21:22.640Z","database_specific":{"cna_assigner":"drupal","cwe_ids":["CWE-267"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/96xxx/CVE-2026-96390.json"},"references":[{"type":"WEB","url":"https://git.drupalcode.org/project/editoria11y"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/96xxx/CVE-2026-96390.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96390"},{"type":"WEB","url":"https://www.drupal.org/project/editoria11y"},{"type":"WEB","url":"https://www.drupal.org/sa-contrib-2026-185"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.drupalcode.org/project/editoria11y","events":[{"introduced":"0"},{"fixed":"4a5415bfcadb0e8ecb7fd00d7727f66d8f50c021"},{"introduced":"ae11f3647c36ed328e0127db7bf31c4f4fa21007"},{"fixed":"43edc61ba62bae400176c19b0848c00dcae919d1"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"0.0.0"},{"fixed":"2.2.23"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"},{"range":[{"introduced":"3.0.0"},{"fixed":"3.0.9"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"}]}}],"versions":["2.2.22","3.0.8","3.0.7","3.0.6","3.0.5","3.0.4","3.0.3","3.0.2","3.0.1","3.0.0-rc2","3.0.0","2.2.21","2.2.20","2.2.19","2.2.18","2.2.17","2.2.16","2.2.15","2.2.14","2.2.13","2.2.12","2.2.11","2.2.10","2.2.9","2.2.8","2.2.7","2.2.6","2.2.5","2.2.4","2.2.3","2.2.2","2.2.1","2.2.0","2.2.0-rc10","2.2.0-rc9","2.2.0-rc8","2.2.0-rc7","2.2.0-rc6","2.2.0-rc5","2.2.0-rc4","2.2.0-rc3","2.2.0-rc2","2.2-rc2","2.2.0-rc1","2.2.0-beta6","2.2.0-beta5","2.2.0-beta4","2.1.19","2.2.0-beta3","2.2.0-beta2","2.2.0-beta1","2.1.18","2.1.17","2.1.16","2.1.15","2.1.14","2.1.13","2.1.12","2.1.11","2.1.10","2.1.9","2.1.8","2.1.7","2.1.6","2.1.5","2.1.4","2.1.3","2.1.2","2.1.1","2.1.0","2.0.14","2.0.13","2.0.12","2.0.11","2.0.10","2.0.9","2.0.8","2.0.7","2.0.6","2.0.5","2.0.4","2.0.3","2.0.2","2.0.1","2.0.0","2.0.0-beta12","2.0.0-beta11","2.0.0-beta10","2.0.0-beta9","2.0.0-beta8","2.0.0-beta7","2.0.0-beta6","2.0.0-beta5","2.0.0-beta4","2.0.0-beta3","2.0.0-beta2","2.0.0-beta1","2.0.0-alpha8","2.0.0-alpha7","2.0.0-alpha6","2.0.0-alpha5","2.0.0-alpha4","2.0.0-alpha3","2.0.0-alpha2","2.0.0-alpha1","1.0.12","1.0.11","1.0.10","1.0.9","1.0.8","1.0.7","1.0.6","1.0.5","1.0.4","1.0.3","1.0.2","1.0.1","1.0.0","1.0.0-beta10","1.0.0-beta9","1.0.0-beta8","1.0.0-beta7","1.0.0-beta6","1.0.0-beta5","1.0.0-beta4","1.0.0-beta3","1.0.0-beta2","1.0.0-beta1","1.0.0-Beta1","1.0.0-Beta","1.0.0-alpha10","1.0.0-alpha9","1.0.0-alpha8","1.0.0-alpha7","1.0.0-alpha6","1.0.0-alpha5","1.0.0-alpha4","1.0.0-alpha3","1.0.0-alpha2","1.0.0-alpha1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-96390.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}]}