CVE-2026-84917

Name of the Vulnerable Software and Affected Versions Jsonapi Role Access versions 0.0.0 through 2.0.2

Description An incorrect authorization issue exists in the module used to restrict access to JSON:API routes based on user roles. The module fails to sufficiently enforce access controls when a request mimics an XMLHttpRequest (a browser object used to interact with pages without reloading), which allows forceful browsing.

Recommendations Update Jsonapi Role Access to a version later than 2.0.2.