Drupal Entity API CVE-2026-81158

The Drupal Entity API contributed module must be installed and enabled at a version between 0.0.0 and 1.7.x (inclusive). The site must have restricted entity content - nodes, users, or other entities with access controls applied. The attacker must be able to discover or enumerate valid entity URLs, which is facilitated by Drupal's predictable sequential node IDs. No authentication is required (PR:N per CVSS). Sites with exclusively public content have no meaningful exposure. Access is limited to read-only confidentiality impact; no write or destructive operations are enabled by this flaw.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N scores 5.3 (Medium), reflecting a network-accessible, unauthenticated flaw with low complexity and limited confidentiality impact only - no integrity or availability dimensions apply. Real-world risk depends heavily on what restricted entities are exposed: a site hosting sensitive unpublished content or private user data presents materially higher risk than a site with only public content. The CVSS C:L rating is accurate for a generic assessment but could understate impact on specific deployments. Even a mid-sized municipal IT team in gniezno running a content-heavy Drupal intranet should treat this as an upgrade priority given the zero-authentication requirement. No EPSS score is provided in the input data, and the CVE is not listed in CISA KEV, nor is any public proof-of-concept identified - this is a vendor-disclosed, patch-available medium-priority issue rather than an actively exploited emergency. The mismatch between the 'Authentication Bypass' tag and the actual CWE-863 (Incorrect Authorization) is a data quality issue but does not affect risk scoring.

An unauthenticated attacker who knows or enumerates Drupal entity node IDs (e.g., /node/42, /user/7) sends direct HTTP GET requests to those URLs. Because the Entity API module fails to correctly enforce access checks, the server returns content that should be restricted to authenticated or privileged users. No exploit code is required beyond a standard web browser or curl.