CVE-2026-3527 - Vulnerability Details - OpenCVE

Missing Authentication for Critical Function vulnerability in Drupal AJAX Dashboard allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AJAX Dashboard: from 0.0.0 before 3.1.0.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://www.drupal.org/sa-contrib-2026-022

History

Thu, 26 Mar 2026 20:30:00 +0000

Type	Values Removed	Values Added
Description		Missing Authentication for Critical Function vulnerability in Drupal AJAX Dashboard allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AJAX Dashboard: from 0.0.0 before 3.1.0.
Title		AJAX Dashboard - Critical - Access bypass - SA-CONTRIB-2026-022
Weaknesses		CWE-306
References		https://www.drupal.org/sa-contrib-2026-022

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: drupal

Published: 2026-03-26T20:03:05.935Z

Updated: 2026-03-26T20:03:05.935Z

Reserved: 2026-03-04T16:41:55.560Z

Link: CVE-2026-3527

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-03-26T21:17:08.757

Modified: 2026-03-26T21:17:08.757

Link: CVE-2026-3527

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-306

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3527", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "state": "PUBLISHED", "assignerShortName": "drupal", "dateReserved": "2026-03-04T16:41:55.560Z", "datePublished": "2026-03-26T20:03:05.935Z", "dateUpdated": "2026-03-26T20:03:05.935Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2026-03-26T20:03:05.935Z"}, "title": "AJAX Dashboard - Critical - Access bypass - SA-CONTRIB-2026-022", "datePublic": "2026-03-04T17:57:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-306", "description": "CWE-306 Missing Authentication for Critical Function", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"}]}], "affected": [{"vendor": "Drupal", "product": "AJAX Dashboard", "collectionURL": "https://www.drupal.org/project/ajax_dashboard", "repo": "https://git.drupalcode.org/project/ajax_dashboard", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "3.1.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Missing Authentication for Critical Function vulnerability in Drupal AJAX Dashboard allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AJAX Dashboard: from 0.0.0 before 3.1.0.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Missing Authentication for Critical Function vulnerability in Drupal AJAX Dashboard allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects AJAX Dashboard: from 0.0.0 before 3.1.0.</p>"}]}], "references": [{"url": "https://www.drupal.org/sa-contrib-2026-022"}], "credits": [{"lang": "en", "value": "Juraj Nemec (poker10)", "type": "finder"}, {"lang": "en", "value": "Michael Nolan (laboratory.mike)", "type": "remediation developer"}, {"lang": "en", "value": "Bram Driesen (bramdriesen)", "type": "coordinator"}, {"lang": "en", "value": "Greg Knaddison (greggles)", "type": "coordinator"}, {"lang": "en", "value": "Juraj Nemec (poker10)", "type": "coordinator"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}}}