View online: https://www.drupal.org/sa-contrib-2026-208 Project: DKAN [1] Project machine name: dkan Date: 2026-October-07 Security risk: *Moderately critical* 11 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <4.0.4 || >=4.1.0 <4.1.5 CVE IDs: CVE-2026-107267 Description: The DKAN module enables organizations and individuals to build open data portals in Drupal. The DKAN datastore imports tabular data files into database tables and exposes them for querying with a JSON API. The module does not correctly check access for all of its endpoints, leading to a potential access bypass. The vulnerability is mitigated by the fact that it is only impactful for sites that do not give "access content" permission to the anonymous role. Solution: Install the latest version: * If you use DKAN 4.1.x, upgrade to DKAN 4.1.5 [3] * If you use DKAN 4.0.x, upgrade to DKAN 4.0.4 [4] Reported By: * Rodel Duterte (rduterte) [5] Fixed By: * Dan Feder (dafeder) [6] * Rodel Duterte (rduterte) [7] * Steve Wirt (swirt) [8] Coordinated By: * Swan Kalata (akalata) [9] of the Drupal Security Team * Greg Knaddison (greggles) [10] of the Drupal Security Team * Juraj Nemec (poker10) [11] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/dkan [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/dkan/releases/4.1.5 [4] https://www.drupal.org/project/dkan/releases/4.0.4 [5] https://www.drupal.org/u/rduterte [6] https://www.drupal.org/u/dafeder [7] https://www.drupal.org/u/rduterte [8] https://www.drupal.org/u/swirt [9] https://www.drupal.org/u/akalata [10] https://www.drupal.org/u/greggles [11] https://www.drupal.org/u/poker10 [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....