CVE-2026-73478: Drupal Diff Auth Bypass Vulnerability

CVE-2026-73478 Overview

CVE-2026-73478 is an Incorrect Authorization vulnerability [CWE-863] in the Drupal Diff contributed module. The flaw enables forceful browsing, allowing unauthenticated network attackers to access content that should be restricted by authorization checks. The issue affects Diff versions 0.0.0 through 2.0.1 and versions 2.1.0 through 2.1.1. Successful exploitation results in limited disclosure of information without impact to integrity or availability.

Critical Impact
Unauthenticated attackers can bypass access controls in the Drupal Diff module to view content revisions and diffs they are not authorized to see.

Affected Products

Drupal Diff module versions 0.0.0 to 2.0.1
Drupal Diff module versions 2.1.0 to 2.1.1
Drupal sites using the contributed Diff module for revision comparison

Discovery Timeline

2026-09-02 - CVE-2026-73478 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-73478

Vulnerability Analysis

The Drupal Diff module provides functionality to compare revisions of nodes and other content entities. The module fails to consistently enforce authorization checks on the endpoints that render diff output between revisions. Attackers can reach these endpoints through direct URL requests, a class of attack referred to as forceful browsing.

Because the authorization check is incorrect rather than absent, requests that should be denied are processed and return revision content. The vulnerability requires no authentication, no user interaction, and can be triggered over the network.

Root Cause

The root cause is an Incorrect Authorization weakness [CWE-863]. The Diff module's access control logic does not correctly evaluate whether the requesting user has permission to view the underlying entity revisions being compared. Access decisions rely on incomplete checks, permitting requests that should be blocked by Drupal's entity access API.

Attack Vector

Exploitation is performed over the network by issuing crafted HTTP requests to the Diff module's revision comparison routes. An unauthenticated attacker enumerates entity and revision identifiers and requests the diff view directly. The server returns rendered differences containing content that the anonymous role should not access. No exploitation code is publicly available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

See the Drupal Security Advisory 2026-096 for vendor-provided technical details.

Detection Methods for CVE-2026-73478

Indicators of Compromise

Anonymous or low-privileged HTTP requests to Diff module routes such as paths containing /diff/ or revisions/view.
Elevated request volume enumerating sequential node identifiers and revision IDs from a single source.
Access log entries returning HTTP 200 responses for diff endpoints from users without the required roles.

Detection Strategies

Review Drupal web server access logs for unauthenticated requests to Diff module URLs and correlate against configured node access permissions.
Deploy web application firewall rules that flag requests to diff routes lacking a valid authenticated session cookie.
Compare Diff module responses against expected role-based access to identify unauthorized disclosures.

Monitoring Recommendations

Enable verbose logging on the Diff module and forward events to a centralized SIEM for correlation.
Alert on repeated 403-to-200 transitions on the same endpoint indicating access control drift.
Track outbound response sizes on diff endpoints for anomalies that suggest bulk revision scraping.

How to Mitigate CVE-2026-73478

Immediate Actions Required

Upgrade the Drupal Diff module to a fixed release as listed in the Drupal Security Advisory 2026-096.
Inventory all Drupal sites using the Diff module and confirm installed versions against the affected ranges.
Restrict anonymous access to revision comparison functionality until the module is patched.

Patch Information

Drupal has published fixed versions of the Diff module. Administrators must upgrade beyond the affected ranges 0.0.0 to 2.0.1 and 2.1.0 to 2.1.1 by installing the release identified in the Drupal Security Advisory 2026-096. Apply the update using composer update drupal/diff followed by database updates via drush updatedb.

Workarounds

Temporarily disable the Diff module via drush pm:uninstall diff if patching cannot be performed immediately.
Block anonymous access to Diff module paths at the reverse proxy or web application firewall layer.
Restrict the access content and revision-viewing permissions to authenticated roles only until the fix is deployed.

bash

# Configuration example
composer update drupal/diff --with-dependencies
drush updatedb -y
drush cache:rebuild