CVE-2026-3525: File Access Fix Auth Bypass Vulnerability

CVE-2026-3525 Overview

CVE-2026-3525 is an incorrect authorization vulnerability in the Drupal File Access Fix module, a contributed module maintained by geeks4change. The flaw allows unauthenticated attackers to perform forceful browsing against protected resources because authorization checks are not properly enforced. The issue affects all versions of file_access_fix prior to 1.2.0. The module has since been deprecated. The weakness is categorized under CWE-863: Incorrect Authorization and is exploitable remotely over the network without user interaction.

Critical Impact
Unauthenticated attackers can access files that should be restricted, resulting in confidentiality loss on affected Drupal sites running the File Access Fix module before version 1.2.0.

Affected Products

Drupal File Access Fix module (geeks4change/file_access_fix) versions 0.0.0 through 1.1.x
Drupal sites with the deprecated File Access Fix module installed
Any Drupal deployment relying on this module to enforce file access controls

Discovery Timeline

2026-03-26 - CVE-2026-3525 published to NVD
2026-03-26 - Drupal Security Advisory SA-CONTRIB-2026-020 released
2026-03-31 - Last updated in NVD database

Technical Details for CVE-2026-3525

Vulnerability Analysis

The File Access Fix module was designed to address gaps in Drupal's default file access enforcement. The module fails to consistently apply authorization checks before returning file resources. As a result, an attacker who guesses or enumerates file paths can retrieve content intended for authenticated or privileged users. The attack requires no credentials and no user interaction. The vulnerability is classified as forceful browsing, where an attacker directly requests URLs or resources outside the intended navigation flow. Exploitation impacts confidentiality but does not directly affect integrity or availability of the target system. The EPSS score is 0.043%, indicating low predicted exploitation activity at the time of publication, though contributed Drupal modules are recurring targets for opportunistic scanners.

Root Cause

The root cause is an incomplete authorization check within the module's file access logic. The module returns protected file contents without verifying that the requesting user holds the required permission grants. This violates the principle of complete mediation described in CWE-863.

Attack Vector

An unauthenticated remote attacker sends crafted HTTP requests to file endpoints exposed by a Drupal site running the vulnerable module. By iterating predictable file identifiers or paths, the attacker retrieves files that should require authentication or specific role permissions. No specialized tooling is required, and standard HTTP clients are sufficient. See the Drupal Security Advisory for vendor-confirmed exploitation details.

Detection Methods for CVE-2026-3525

Indicators of Compromise

Unauthenticated HTTP GET requests to /system/files/, /sites/default/files/private/, or related file routes returning 200 OK responses
Sequential or enumerated requests against file IDs or paths from a single source address
Anonymous user sessions accessing files marked as private in Drupal's file storage

Detection Strategies

Inspect Drupal access logs for high-volume requests to file endpoints originating from anonymous sessions
Cross-reference Drupal's watchdog or syslog output with web server logs to confirm whether served files were tied to authenticated requests
Run drush pm:list or query the system schema to identify sites with file_access_fix installed below version 1.2.0

Monitoring Recommendations

Forward Drupal application logs and reverse proxy access logs to a centralized log platform for correlation
Alert on bursts of anonymous file downloads or 200-status responses on private file paths
Track installed module inventory across Drupal estates to detect deprecated modules still in production

How to Mitigate CVE-2026-3525

Immediate Actions Required

Update the file_access_fix module to version 1.2.0 or later on all Drupal sites
Because the module is deprecated, plan migration to a supported alternative or remove the module entirely if no longer required
Audit private file directories for evidence of unauthorized retrieval since the module was deployed

Patch Information

The maintainer released version 1.2.0 to address the incorrect authorization flaw. Refer to the Drupal Security Advisory SA-CONTRIB-2026-020 for download links and upgrade guidance. Since the module is marked deprecated, administrators should evaluate whether Drupal core file access mechanisms or an actively maintained module can replace its functionality.

Workarounds

Disable and uninstall the file_access_fix module if patching is not immediately feasible
Restrict access to private file directories at the web server or reverse proxy layer until the module is updated or removed
Apply web application firewall rules to block anonymous requests against private file endpoints

bash

# Identify and update the vulnerable Drupal module
drush pm:list --type=module --status=enabled | grep file_access_fix
composer require 'drupal/file_access_fix:^1.2.0'
drush updatedb -y
drush cache:rebuild