View online: https://www.drupal.org/sa-contrib-2026-206 Project: Xray Audit [1] Project machine name: xray_audit Date: 2026-October-07 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <1.1.1 || >=2.0.0 <2.0.4 || >=3.1.0 <3.1.1 || 1.2.* || 1.3.* || 1.4.* || 1.5.* || 3.0.* CVE IDs: CVE-2026-96389 Description:  This module enables you to audit a Drupal site by generating reports about its content, entities, display modes and configuration. The module doesn't sufficiently check entity access when rendering an entity through the display-mode example route. This allows an attacker to view unpublished or otherwise access-restricted content. This vulnerability is mitigated by the fact that field-level access is still enforced, so fields that are themselves access-restricted (for example a user's email or password hash) are not disclosed. Solution:  Install the latest versions: * If you use the X-ray Audit version 3.1.x, upgrade to X-ray Audit 3.1.1 [3]. * If you use the X-ray Audit version 2.0.x, upgrade to X-ray Audit 2.0.4 [4]. * If you use the X-ray Audit version 1.6.x, upgrade to X-ray Audit 1.6.3 [5]. Reported By:  * eduardo morales alberti [6] * Hemant Gupta (guptahemant) [7] * Marcus Johansson (marcus_johansson) [8] * Drew Webber (mcdruid) [9] of the Drupal Security Team Fixed By:  * Luis Ruiz Peidró (lpeidro) [10] Coordinated By:  * Swan Kalata (akalata) [11] of the Drupal Security Team * Greg Knaddison (greggles) [12] of the Drupal Security Team * Juraj Nemec (poker10) [13] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [14] [1] https://www.drupal.org/project/xray_audit [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/xray_audit/releases/3.1.1 [4] https://www.drupal.org/project/xray_audit/releases/2.0.4 [5] https://www.drupal.org/project/xray_audit/releases/1.6.3 [6] https://www.drupal.org/u/eduardo-morales-alberti [7] https://www.drupal.org/u/guptahemant [8] https://www.drupal.org/u/marcus_johansson [9] https://www.drupal.org/u/mcdruid [10] https://www.drupal.org/u/lpeidro [11] https://www.drupal.org/u/akalata [12] https://www.drupal.org/u/greggles [13] https://www.drupal.org/u/poker10 [14] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....