DRUPAL-CONTRIB-2026-021
NoneCVSS
—
EPSS
—
Published
Mar 4, 2026
CISA due date
—
The record
This module moves files to and from private storage depending on the access of its owning entities. The module does not always validate the access logic correctly, resulting in files attached to an entity not being protected in certain circumstances. This vulnerability is mitigated by the fact that saving an entity a second time resolves the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist:https://packages.drupal.org/8 | drupal/file_access_fix | 0 | 1.2.0 |
Related vulnerabilities
- CVE-2026-3526 Incorrect Authorization vulnerability in Drupal File Access Fix (deprecated) allows… Same vulnerability
- CVE-2026-3525 Incorrect Authorization vulnerability in Drupal File Access Fix (deprecated) allows… Also affects drupal/file_access_fix
- DRUPAL-CONTRIB-2026-020 This module moves files to and from private storage depending on the access of its owning… Also affects drupal/file_access_fix