Improper Authorization in Drupal's Entity API Affects Various Versions
CVE-2026-81158

5.3MEDIUM

Key Information:

Vendor

Drupal
Status
Entity Api
Vendor
CVE Published:
2 September 2026

What is CVE-2026-81158?

The Entity API in Drupal suffers from an incorrect authorization vulnerability that permits unauthorized access through forceful browsing. This flaw can lead to exposure of sensitive data by allowing users to access resources beyond their permitted boundaries. It is essential for users of Entity API versions ranging from 0.0.0 to 1.8.0 to apply necessary patches and updates to safeguard against potential exploitation.

Affected Version(s)

Entity API 0.0.0 < 1.8.0

References

https://www.drupal.org/sa-contrib-2026-113

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Douglas Groene (dgroene)
Matt Glaman (mglaman)
Sascha Grossenbacher (berdir)
Klaus Purer (klausi)
Kristiaan Van den Eynde (kristiaanvandeneynde)
Matt Glaman (mglaman)
Swan Kalata (akalata)
Greg Knaddison (greggles)
Lee Rowlands (larowlan)
Juraj Nemec (poker10)
Jess (xjm)
.