Drupal · Role Delegation · CVE-2026-0945
**Name of the Vulnerable Software and Affected Versions**
Drupal Role Delegation versions 1.3.0 through 1.4.9
**Description**
A privilege escalation issue exists in the Role Delegation module. The module allows site administrators to grant specific roles the authority to assign selected roles to users, without needing the 'administer permissions' permission. A vulnerability allows a user with the ability to delegate a role to also assign the administrator role, even to their own user account. This is possible when the module is used with the Views Bulk Operations module and an attacker has access to a view of users with the Views Bulk Operations module enabled.
**Recommendations**
Update to Role Delegation version 1.5.0 or later.