All vulnerabilities
CVE-2026-96390

Editoria11y Accessibility Checker - Moderately critical - Access bypass - SA-CONTRIB-2026-185

Drupal Editoria11y Accessibility CheckerApplications & CMS
Open in ThreatlineRecord JSON
CVSS
4.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.15%Chance of exploitation activity in the next 30 days, higher than 4% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2.2.23Also 3.0.9CVE List
Published22 Oct 2026Updated 22 Oct 2026CVE List

What fixes it

  • 2.2.23Editoria11y Accessibility CheckerCVE List
  • 3.0.9Editoria11y Accessibility CheckerCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Privilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Accessibility Checker allows Privilege Escalation. This issue affects Editoria11y Accessibility Checker versions: from 0.0.0 to 2.2.23, from 3.0.0 to 3.0.9.

Text from CVE List

Affected versions 2

  • Editoria11y Accessibility Checkeraffected: 0.0.0 before 2.2.23CVE List
  • Editoria11y Accessibility Checkeraffected: 3.0.0 before 3.0.9CVE List

References 1