CVE-2026-84917 in Jsonapi Role Access Plugin
Summary
by MITRE • 10/22/2026
Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This issue affects Jsonapi Role Access versions: from 0.0.0 to 2.0.2.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/22/2026
The identified security flaw resides within the Jsonapi Role Access module for Drupal, specifically affecting version ranges from 0.0.0 through 2.0.2. This vulnerability is classified as an Incorrect Authorization issue, which fundamentally represents a failure in the application to properly enforce access control policies when handling requests directed at JSON API endpoints. In secure web applications, authorization mechanisms must verify that the authenticated user possesses the necessary permissions for every specific action they attempt to perform on server resources. However, due to this implementation defect, the module fails to adequately validate these permissions during certain operations, thereby creating a gap in the security boundary between authorized and unauthorized users.
This technical flaw enables attackers to execute Forceful Browsing attacks against the targeted Drupal instance. Forceful browsing, also known as path traversal or insecure direct object reference exploitation in this context, allows an adversary to access resources that they should not have permission to view or manipulate. By crafting specific HTTP requests with manipulated parameters or headers, a malicious actor can bypass intended restrictions and interact with administrative functions, sensitive data structures, or configuration settings that are typically restricted to users with higher privilege levels such as site administrators. The lack of rigorous checks means the server processes these unauthorized requests as if they were legitimate, leading to potential information disclosure or further system compromise depending on the specific endpoints exposed through the JSON API interface.
The operational impact of this vulnerability is significant for any organization relying on Drupal and its JSON API integration for content management or data exchange. Successful exploitation can lead to the exposure of confidential site configurations, user credentials stored in associated tables, or proprietary content that was intended to be private. Furthermore, if the affected endpoints allow write operations with insufficient authorization checks, an attacker could potentially modify or delete critical data, deface the website, or use the compromised system as a pivot point for deeper network intrusion. This undermines the integrity and confidentiality guarantees provided by the CMS platform and can result in regulatory non-compliance depending on the nature of the exposed data.
To mitigate this risk, administrators must immediately upgrade the Jsonapi Role Access module to version 2.0.3 or later, where these authorization checks have been corrected. Until an update is applied, it is advisable to restrict access to JSON API endpoints using web application firewall rules that limit exposure based on IP address or require additional authentication layers such as OAuth tokens with strict scope definitions. Regular security audits and penetration testing should be conducted to verify that no other similar flaws exist in the custom codebase interacting with these APIs. This incident aligns with CWE-269, which describes Improper Privilege Management, highlighting the critical need for robust access control logic in all API implementations within modern web architectures.