CVE-2026-84910: Drupal Advanced Search Module Block Access Vulnerability
Summary
CVE-2026-84910: This module enables AJAX updates for advanced search, facet, and search result blocks. Affects drupal/advanced_search versions < 2.4.5. Fixed in 2.4.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Drupal Advanced Search module enhances the search functionality of Drupal sites by enabling AJAX updates for advanced search, facet, and search result blocks. It allows users to interactively filter and refine search results without needing to reload the page. However, this module has a critical vulnerability that can expose restricted block content to unauthorized users.
Vulnerability Detail
This vulnerability arises from inadequate access checks for block IDs submitted to the module's publicly accessible AJAX endpoint. An unauthenticated attacker could exploit this flaw to retrieve sensitive content from restricted blocks if they can guess or know the machine ID of those blocks. The risk is particularly concerning for sites that rely on block access or visibility restrictions to protect sensitive information.
How To Fix
Minimum fixed version
2.4.5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds to mitigate this vulnerability without applying the patch. It is highly recommended to update to the fixed version as soon as possible.
Conclusion
In summary, CVE-2026-84910 is a significant vulnerability in the Drupal Advanced Search module that can expose restricted content to unauthorized users. It is imperative to update to version 2.4.5 or later to mitigate this risk effectively.
See every vulnerability recorded for drupal/advanced_search →
FAQ
CVE-2026-84910 is a vulnerability in the Drupal Advanced Search module that allows unauthorized access to restricted block content through a flaw in AJAX endpoint access checks.
Any Drupal site using the Advanced Search module versions prior to 2.4.5 is potentially affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
While there are no specific workarounds, it is crucial to prioritize updating the module to the patched version to protect your site from potential exploitation.
Failure to address this vulnerability could lead to unauthorized access to sensitive content on your site, potentially compromising user data and trust.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
