DXPR Builder CVE-2026-81162

No special configuration is required beyond having DXPR Builder installed and the Drupal site accessible over the network. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms remote unauthenticated exploitation with no user interaction and low attack complexity against any default installation of DXPR Builder 0.0.0 through 2.8.0. Exploitation is limited to information disclosure with low confidentiality impact (C:L); the vulnerability does not provide write access or code execution capability. Sites that restrict DXPR Builder endpoints to authenticated users via Drupal permissions or network-layer controls would limit exposure.

The CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects a straightforward, network-reachable, unauthenticated endpoint that leaks limited information - appropriate for this class of forceful-browsing disclosure. The impact is bounded to confidentiality at the Low level, with no integrity or availability consequences, which correctly constrains the score to Medium rather than High. No EPSS data was provided, no KEV listing exists, and no public proof-of-concept has been identified, meaning real-world exploitation pressure is likely low; even a mid-sized municipal IT team in tczew managing a Drupal estate should treat this as a routine patch-cycle item rather than an emergency response. The primary risk lies in sites running DXPR Builder that expose it publicly without compensating access controls, where an attacker could enumerate and retrieve sensitive configuration or content data without credentials - a risk amplified if the leaked information (e.g., API keys, internal paths, or user data) serves as a stepping stone for a follow-on attack.

An unauthenticated remote attacker identifies a publicly accessible Drupal site running DXPR Builder and directly requests internal or administrative endpoint URLs that the module exposes without proper access control checks. The server returns a response containing sensitive information - such as configuration values, internal paths, or content data - that should require authentication to access. No proof-of-concept code has been identified, but the low complexity of forceful browsing means manual exploration or automated crawling is sufficient to trigger the disclosure.