The Drupal Editoria11y Accessibility Checker module contains a privilege-defined-with-unsafe-actions vulnerability that enables privilege escalation. This flaw allows a user with adequate authentication to perform actions that should be restricted, effectively bypassing access controls according to CWE-267. By exploiting the unsafe privilege definitions, an attacker could gain elevated permissions within the Drupal site, potentially altering content or configuration beyond their normal authorization.

Affected systems include Drupal installations using the Editoria11y Accessibility Checker module, specifically versions from 0.0.0 through 2.2.23 and from 3.0.0 through 3.0.9. All other product versions are considered unaffected. Administrators should verify which version of the module is currently deployed and whether it falls within the affected range.

The EPSS score of < 1% and absence in KEV indicates a low exploitation probability, while the CVSS score of 4.3 reflects moderate severity for privilege escalation. The attack vector is most likely via authenticated HTTP requests to the module's endpoints, as the vulnerability is tied to internal privilege handling. Immediate mitigation through upgrading or disabling the module is recommended.