CVE-2026-96390

Full vulnerability record from the local CVENow database.

Description

Privilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Accessibility Checker allows Privilege Escalation. This issue affects Editoria11y Accessibility Checker versions: from 0.0.0 to 2.2.23, from 3.0.0 to 3.0.9.

Severity

MEDIUM

CVSS score

4.3 (v3.1)

Vulnerability status

Awaiting Analysis

Source identifier

[email protected]

Published

2026-10-22 02:17:09.237000

Last modified

2026-10-22 16:54:17.390000

View original CVE JSON

{
  "id": "CVE-2026-96390",
  "sourceIdentifier": "[email protected]",
  "published": "2026-10-22T02:17:09.237",
  "lastModified": "2026-10-22T16:54:17.390",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Privilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Accessibility Checker allows Privilege Escalation. This issue affects Editoria11y Accessibility Checker versions: from 0.0.0 to 2.2.23, from 3.0.0 to 3.0.9."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Drupal",
          "product": "Editoria11y Accessibility Checker",
          "collectionURL": "https://www.drupal.org/project/editoria11y",
          "repo": "https://git.drupalcode.org/project/editoria11y",
          "versions": [
            {
              "version": "0.0.0",
              "lessThan": "2.2.23",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "3.0.0",
              "lessThan": "3.0.9",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-10-22T14:01:38.215167Z",
          "id": "CVE-2026-96390",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-267"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.drupal.org/sa-contrib-2026-185",
      "source": "[email protected]"
    }
  ]
}