CVE-2026-96389

Name of the Vulnerable Software and Affected Versions Drupal Xray Audit versions 0.0.0 through 1.6.3 Drupal Xray Audit versions 2.0.0 through 2.0.4 Drupal Xray Audit versions 3.0.0 through 3.1.1

Description An authorization flaw allows forceful browsing by failing to sufficiently check entity access when rendering an entity through the display-mode example route. This enables an attacker to view unpublished or access-restricted content. Field-level access remains enforced, preventing the disclosure of restricted fields such as email addresses or password hashes.

Recommendations Update Drupal Xray Audit versions 0.0.0 through 1.6.3 to a version newer than 1.6.3. Update Drupal Xray Audit versions 2.0.0 through 2.0.4 to a version newer than 2.0.4. Update Drupal Xray Audit versions 3.0.0 through 3.1.1 to a version newer than 3.1.1.