PT-2026-2979 · Drupal+2 · Role Delegation+1

Adam Bramley + 4 · Published 2026-01-14 · Updated 2026-02-11 · CVE-2026-0945

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Drupal Role Delegation versions 1.3.0 through 1.4.9

Description A privilege escalation issue exists in the Role Delegation module. The module allows site administrators to grant specific roles the authority to assign selected roles to users, without needing the 'administer permissions' permission. A vulnerability allows a user with the ability to delegate a role to also assign the administrator role, even to their own user account. This is possible when the module is used with the Views Bulk Operations module and an attacker has access to a view of users with the Views Bulk Operations module enabled.

Recommendations Update to Role Delegation version 1.5.0 or later.

Fix

LPE

Weakness Enumeration

CWE-267

Related Identifiers

CVE-2026-0945

DRUPAL-CONTRIB-2026-002

Affected Products

Role Delegation

Drupal/Role Delegation

References · 6

• https://drupal.org/sa-contrib-2026-002 · Vendor Advisory
• https://osv.dev/vulnerability/DRUPAL-CONTRIB-2026-002 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-0945 · Security Note
• https://t.me/cveNotify/151785 · Telegram Post
• https://twitter.com/CVEnew/status/2019182774977196243 · Twitter Post
• https://t.me/CVEtracker/43759 · Telegram Post