PT-2026-22082 · Drupal+2 · Material Icons+1

Bryan Sharpe + 6 · Published 2026-02-25 · Updated 2026-03-30 · CVE-2026-3210

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Drupal Material Icons versions prior to 2.0.4

Description The Drupal Material Icons module has an authorization issue. Insufficient permissions are added to dialog and autocomplete routes, potentially granting full access to these routes in many situations. This allows for forceful browsing. The module is designed to add icons to CKEditor.

Recommendations Update to version 2.0.4 or later.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-3210

DRUPAL-CONTRIB-2026-011

Affected Products

Material Icons

Drupal/Material Icons

References · 4

• https://osv.dev/vulnerability/DRUPAL-CONTRIB-2026-011 · Vendor Advisory
• https://drupal.org/sa-contrib-2026-011 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3210 · Security Note
• https://twitter.com/CVEnew/status/2038618168818561117 · Twitter Post