CVE-2026-0945: Drupal Role Delegation Privilege Escalation

CVE-2026-0945 Overview

A Privilege Defined With Unsafe Actions vulnerability exists in the Drupal Role Delegation module that allows Privilege Escalation. This vulnerability stems from CWE-267 (Privilege Defined With Unsafe Actions), where the module grants users permissions that inadvertently allow them to perform actions beyond their intended access level. Attackers with limited authenticated access can exploit this flaw to escalate their privileges within the Drupal content management system.

Critical Impact

Authenticated users with access to Role Delegation functionality can escalate their privileges to gain unauthorized administrative or elevated access within the Drupal installation.

Affected Products

• Drupal Role Delegation module versions 1.3.0 to 1.4.x (prior to 1.5.0)

Discovery Timeline

• 2026-02-04 - CVE CVE-2026-0945 published to NVD
• 2026-02-05 - Last updated in NVD database

Technical Details for CVE-2026-0945

Vulnerability Analysis

The vulnerability resides in the Drupal Role Delegation contributed module, which is designed to allow site administrators to delegate the ability to assign specific roles to other users. The core issue lies in how the module defines and enforces privilege boundaries, falling under CWE-267: Privilege Defined With Unsafe Actions.

When privileges are defined with unsafe actions, the module fails to properly restrict what roles a delegated user can assign. This creates a privilege escalation vector where users granted limited role assignment capabilities can potentially assign roles with higher privileges than they themselves possess, including administrative roles.

The vulnerability affects all versions of the Role Delegation module from 1.3.0 up to but not including 1.5.0. Organizations running Drupal installations with this module in the affected version range should prioritize remediation.

Root Cause

The root cause is a flaw in the permission model implementation within the Role Delegation module. The module allows users to assign roles without adequately verifying whether the assigning user should have the authority to grant those specific roles. This violates the principle of least privilege, as users can effectively grant themselves or others access beyond what the site administrator intended.

Attack Vector

An attacker who has been delegated the ability to assign certain roles can exploit this vulnerability to:

1. Assign themselves higher-privileged roles than intended
2. Create new accounts with elevated privileges
3. Modify existing accounts to gain administrative access
4. Bypass access control restrictions designed to limit their capabilities

The attack requires authenticated access and specific permission to use the Role Delegation functionality. Once the attacker identifies that they can assign roles, they can leverage the unsafe privilege definitions to escalate their access level.

The vulnerability mechanism involves improper validation of role assignment permissions. When a delegated user attempts to assign a role, the module does not sufficiently verify that the target role is within the scope of roles the user is authorized to delegate. For detailed technical information, refer to the Drupal Security Advisory.

Detection Methods for CVE-2026-0945

Indicators of Compromise

• Unexpected role assignments in Drupal user accounts, particularly to administrative roles
• Users with Role Delegation permissions suddenly having elevated access
• Audit log entries showing role changes made by users who shouldn't have that capability
• New administrator accounts created by non-administrative users

Detection Strategies

• Review Drupal watchdog logs for role assignment events from users with limited delegation permissions
• Implement monitoring for changes to user roles, especially escalation to administrative roles
• Conduct periodic audits of user permissions and role assignments to detect unauthorized changes
• Monitor for access to administrative paths by users who recently received role changes

Monitoring Recommendations

• Enable detailed logging for all role assignment operations in Drupal
• Configure alerts for any assignment of administrative or high-privilege roles
• Implement file integrity monitoring on Drupal core and contributed module files
• Review user session data for anomalous access patterns following role changes

How to Mitigate CVE-2026-0945

Immediate Actions Required

• Update the Drupal Role Delegation module to version 1.5.0 or later immediately
• Audit all current role assignments to identify any unauthorized privilege escalations
• Review users who have been granted Role Delegation permissions
• Temporarily revoke Role Delegation permissions until the patch is applied if immediate update is not possible

Patch Information

The vulnerability has been addressed in Role Delegation module version 1.5.0. Site administrators should update to this version or later using Drupal's standard module update process. For complete patch information and update instructions, see the Drupal Security Advisory.

Workarounds

• Disable the Role Delegation module entirely until the patch can be applied
• Restrict Role Delegation permissions to only fully trusted administrators
• Implement additional access control at the server level to limit administrative actions
• Use Drupal's built-in permission system to manually review and restrict which roles can be delegated

# Disable the Role Delegation module via Drush (if update not immediately possible)
drush pm-uninstall role_delegation

# Update the module to the patched version
drush pm-update role_delegation

# Clear Drupal caches after update
drush cache-rebuild