- Package
- drupal/dkan
- Fixed in
- 4.0.4, 4.1.5
- Published
- Wed 7 Oct 2026, 17:33 LisbonUpdated Mon 26 Oct 2026, 04:27 Lisbon
In plain words
Incorrect access checks on some DKAN endpoints may allow an attacker to bypass access restrictions. The issue is only impactful on sites where the anonymous role does not have the access content permission.
Am I affected?
Find drupal/dkan and its version in composer.lock. The advisory lists 4.0.4 and 4.1.5 as fixed versions but gives no affected version ranges. In Drupal, check whether the anonymous role lacks the access content permission, which is the condition the advisory identifies as making the issue impactful.
What to do
Check which version you have, then update to a fixed release for your branch (4.0.4, 4.1.5):
composer show drupal/dkan | grep versions
composer update drupal/dkanIf your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.
If you cannot update yet
The advisory says the issue is mitigated on sites that give the anonymous role the access content permission.
The advisory's description
The DKAN module enables organizations and individuals to build open data portals in Drupal. The DKAN datastore imports tabular data files into database tables and exposes them for querying with a JSON API.
The module does not correctly check access for all of its endpoints, leading to a potential access bypass.
The vulnerability is mitigated by the fact that it is only impactful for sites that do not give "access content" permission to the anonymous role.
The advisory
- OSV.dev: DRUPAL-CONTRIB-2026-208
- The week's digest, with the other advisories from 5 Oct 2026
- All advisories for drupal/dkan