What is the CVSS score of CVE-2026-81164?

CVE-2026-81164 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-81164?

Yes, a patch is available for CVE-2026-81164. Update the affected software to the latest version immediately.

Drupal Entity PDF CVE-2026-81164

EUVD-2026-69999 MEDIUM

Missing Authorization (CWE-862)

2026-09-02 drupal

GHSA-x6xg-8845-hcjr

Drupal Entity Pdf

5.4

CVSS 3.1 · Vendor: drupal

Severity by source

Vendor (drupal) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Requires valid site login (PR:L); access is network-based with no complexity; low C and I for unauthorized entity-PDF retrieval only; no scope change or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (drupal).

CVSS VectorVendor: drupal

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Metadata Corrected

Sep 02, 2026 - 20:40 vuln.today

tag: Authentication Bypass removed

Analysis Generated

Sep 02, 2026 - 20:23 vuln.today

CVSS changed

Sep 02, 2026 - 20:22 NVD

5.4 (MEDIUM)

Patch available

Sep 02, 2026 - 14:17 EUVD

CVE Published

Sep 02, 2026 - 12:31 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Missing Authorization vulnerability in Drupal Entity PDF allows Forceful Browsing. This issue affects Entity PDF versions: from 0.0.0 to 2.1.5.

AnalysisAI

Missing authorization checks in the Drupal Entity PDF contributed module (versions through 2.1.4) expose a Forceful Browsing path that allows any authenticated site user to retrieve PDF renderings of Drupal entities beyond their access rights. The flaw, rooted in CWE-862, means the module generates and serves PDFs without verifying whether the requesting account has view permission on the underlying entity - effectively making every entity accessible to any logged-in user. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires a valid, authenticated Drupal user account at any privilege level - any role that can log in to the site qualifies (confirmed by CVSS PR:L). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 5.4 medium score (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) correctly reflects that a valid site account is required, keeping this below critical tier. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Update the Entity PDF module to version 2.1.5 or later by following the guidance in Drupal security advisory SA-Contrib-2026-114 at https://www.drupal.org/sa-contrib-2026-114. … Detailed patch versions, workarounds, and compensating controls in full report.