AIKIDO-2026-75604

TL;DR

The Xray Audit module previews an entity in a display mode through the display_mode_example route (/xray-audit/{entity_type}/{entity_id}/{view_mode}/example). Affected versions authorize that route with only the access content permission and render the requested entity without an entity view-access check. An attacker can therefore view unpublished or otherwise access-restricted content. Field-level access is still enforced, so fields that are themselves access-restricted, such as a user's email or password hash, are not disclosed. The fix requires the xray_audit access permission and enforces entity view access before the example is rendered.