PatchClock

PHP security digest · 23 Sep 2026

This module runs a client-side accessibility checker that automatically reports results to dashboard views over an API. The module incorrectly described a perm...

Unrated CVE-2026-96390

Package
drupal/editoria11y
Fixed in
2.2.23, 3.0.9
Published
Wed 23 Sep 2026, 18:18 LisbonUpdated Mon 26 Oct 2026, 02:25 Lisbon

In plain words

The module labels a permission as a "view" permission, but it also grants edit and delete access to module data. A user granted that permission could therefore change or delete data when only viewing access was intended.

Am I affected?

Find drupal/editoria11y and its version in composer.lock. The advisory lists fixes in 2.2.23 and 3.0.9, but gives no affected version ranges. Review who has been granted the module permission described as a "view" permission, since it also allows editing and deleting module data.

What to do

Check which version you have, then update to a fixed release for your branch (2.2.23, 3.0.9):

composer show drupal/editoria11y | grep versions
composer update drupal/editoria11y

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

The advisory's description

This module runs a client-side accessibility checker that automatically reports results to dashboard views over an API.

The module incorrectly described a permission as a "view" permission when it grants edit and delete access to module data, resulting in a potential access bypass.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.