Missing Authentication in Drupal AJAX Dashboard Enables Unauthorized Access

Publication date: 2026-03-26

Last updated on: 2026-03-31

Assigner: Drupal.org

Description

Missing Authentication for Critical Function vulnerability in Drupal AJAX Dashboard allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AJAX Dashboard: from 0.0.0 before 3.1.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-03-26

Last Modified

2026-03-31

Generated

2026-07-06

AI Q&A

2026-03-26

EPSS Evaluated

2026-07-05

NVD

CVE-2026-3527

EUVD

EUVD-2026-16379

Affected Vendors & Products

Vendor	Product	Version / Range
ceriumsoft	ajax_dashboard	to 3.1.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability is a Missing Authentication for Critical Function issue in the Drupal AJAX Dashboard. It allows attackers to exploit incorrectly configured access control security levels, potentially enabling unauthorized access to critical functions within the AJAX Dashboard module versions before 3.1.0.

Impact Analysis

The impact of this vulnerability could include unauthorized users gaining access to critical functions in the Drupal AJAX Dashboard, which may lead to unauthorized actions, data exposure, or manipulation within the affected system.

Hi! I’m here to help you understand CVE-2026-3527. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70