CVE-2026-84916: Drupal Islandora Module AJAX Block Access Vulnerability
Summary
CVE-2026-84916: This islandora_advanced_search sub module enables AJAX updates for advanced search, facet, and search result blocks. Affects drupal/islandora versions < 2.19.0. Fixed in 2.19.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Islandora module for Drupal is designed to facilitate advanced search functionalities, including AJAX updates for search, facet, and result blocks. It enhances the user experience by allowing dynamic content updates without full page reloads. However, this module has a critical vulnerability that could expose sensitive block content to unauthorized users.
Vulnerability Detail
The vulnerability arises from insufficient access checks in the 'islandora_advanced_search' submodule when handling AJAX requests. An unauthenticated attacker could exploit this by submitting arbitrary block IDs to the publicly accessible AJAX endpoint, potentially retrieving restricted content. The risk is mitigated by the requirement for the attacker to know or guess the machine ID of the restricted block, which must also contain sensitive information protected by access restrictions. Despite this, the vulnerability poses a significant risk if exploited, especially in configurations where sensitive data is displayed in blocks.
How To Fix
Minimum fixed version
2.19.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is strongly recommended to update to the patched version as soon as possible.
Conclusion
The CVE-2026-84916 vulnerability in the Drupal Islandora module poses a significant risk by allowing unauthorized access to restricted block content through AJAX requests. Immediate action is required to update to the patched version to mitigate this risk.
See every vulnerability recorded for drupal/islandora →
FAQ
CVE-2026-84916 is a vulnerability in the Drupal Islandora module that allows unauthorized access to restricted block content via AJAX requests.
Any Drupal installation using the Islandora module version prior to 2.19.0 is potentially affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
While there are no specific workarounds, it is crucial to monitor your application for any unauthorized access and plan for an update as soon as possible.
If exploited, this vulnerability could lead to unauthorized access to sensitive content, potentially compromising user data and privacy.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/islandora.
