PatchClock

PHP security digest · 7 Oct 2026

This module enables you to audit a Drupal site by generating reports about its content, entities, display modes and configuration. The module doesn't sufficien...

Unrated CVE-2026-96389

Package
drupal/xray_audit
Fixed in
1.6.3, 2.0.4, 3.1.1
Published
Wed 7 Oct 2026, 17:30 LisbonUpdated Mon 26 Oct 2026, 04:25 Lisbon

In plain words

The Xray Audit module does not sufficiently check entity access when rendering an entity through its display-mode example route. An attacker can use this to view unpublished or otherwise access-restricted content. Field-level access checks still apply, so fields that are themselves access-restricted are not disclosed.

Am I affected?

Look for drupal/xray_audit and its version in composer.lock. The advisory lists fixes in 1.6.3, 2.0.4 and 3.1.1, but gives no affected version ranges. The affected feature is entity rendering through the display-mode example route; no additional configuration or database condition is named.

What to do

Check which version you have, then update to a fixed release for your branch (1.6.3, 2.0.4, 3.1.1):

composer show drupal/xray_audit | grep versions
composer update drupal/xray_audit

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

If you cannot update yet

Field-level access is still enforced, so fields that are themselves access-restricted, such as a user's email or password hash, are not disclosed.

The advisory's description

This module enables you to audit a Drupal site by generating reports about its content, entities, display modes and configuration.

The module doesn't sufficiently check entity access when rendering an entity through the display-mode example route. This allows an attacker to view unpublished or otherwise access-restricted content.

This vulnerability is mitigated by the fact that field-level access is still enforced, so fields that are themselves access-restricted (for example a user's email or password hash) are not disclosed.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.