CVE-2026-3526 File Access Fix (deprecated) - Moderately critical - Access bypass - SA-CONTRIB-2026-021
An attacker can bypass authorization checks to access restricted files in the deprecated Drupal File Access Fix module.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-3526?
CVE-2026-3526 is a medium-severity missing authorization vulnerability in Drupal File Access Fix (deprecated), published on 26 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Incorrect Authorization vulnerability in Drupal File Access Fix (deprecated) allows Forceful Browsing.This issue affects File Access Fix (deprecated): from 0.0.0 before 1.2.0.
Weakness: CWE-863
Which versions are affected by CVE-2026-3526?
It affects 1 product.
Linux distribution packages (1)
drupal/file_access_fix Packagist:https://packages.drupal.org/8 | All versions | 1.2.0 |
Products include Geeks4change File Access Fix.
How do I fix CVE-2026-3526?
Upgrade to a fixed version.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-3526 being exploited?
There is no known exploitation of CVE-2026-3526 in the wild and no public exploit code.
Other vulnerabilities in Drupal File Access Fix (deprecated)
Sources
Also known as DRUPAL-CONTRIB-2026-021, GHSA-9pv3-cpwf-mpmj.