AIKIDO-2026-882967
drupal/dkan is vulnerable to Access Bypass
44
Medium Risk
This Affects:
drupal/dkanTL;DR
The DKAN module builds open data portals in Drupal and exposes imported tabular datastore tables through a JSON API. The POST handler for the datastore SQL endpoint allowed every request and did not require the "access content" permission enforced on the GET handler and the other datastore query routes. An anonymous caller can query those tables when the anonymous role does not have "access content". This is mitigated on sites that grant that permission to anonymous users, which is Drupal's default.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and the anonymous role does not have the "access content" permission.
Background info
drupal/dkan is vulnerable to Access Bypass in versions 4.0.0 - 4.0.3 and 4.1.0 - 4.1.4.
How to fix this
Upgrade the drupal/dkan library to the patch version. Use 4.0.4 on the 4.0.x branch or 4.1.5 on the 4.1.x branch.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.