CVE-2026-84917: Drupal JSON:API Role Access Module Access Control Bypass
Summary
CVE-2026-84917: This module enables you to restrict access to JSON:API routes based on specific user roles. Affects drupal/jsonapi_role_access versions < 2.0.2. Fixed in 2.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Drupal JSON:API Role Access module allows developers to restrict access to JSON:API routes based on specific user roles. This functionality is crucial for maintaining security and ensuring that only authorized users can access certain data endpoints. However, the module has a vulnerability that can be exploited if proper access controls are not enforced, potentially exposing sensitive data to unauthorized users.
Vulnerability Detail
The vulnerability arises from insufficient enforcement of access controls when a request mimics an XMLHttpRequest. This flaw allows attackers to bypass the intended restrictions, leading to unauthorized access to JSON:API routes. The implications of this vulnerability can be severe, as it may expose sensitive user data or application functionality to users who should not have access.
How To Fix
Minimum fixed version
2.0.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement additional server-side checks to validate the origin of requests and ensure that only legitimate XMLHttpRequests are processed. However, this is not a substitute for updating the module.
Conclusion
The CVE-2026-84917 vulnerability in the Drupal JSON:API Role Access module poses a significant risk by allowing unauthorized access to restricted routes. It is crucial to update to version 2.0.2 or later to mitigate this risk. Additionally, using tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for drupal/jsonapi_role_access →
FAQ
The impact of this vulnerability is that unauthorized users may gain access to restricted JSON:API routes, potentially exposing sensitive data.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Versions of the Drupal JSON:API Role Access module prior to 2.0.2 are affected by this vulnerability.
Yes, the patch is available in version 2.0.2 of the module. Updating to this version will resolve the vulnerability.
If immediate updating is not possible, consider implementing additional access control measures on your server as a temporary workaround.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
