What is the CVSS score of CVE-2026-81168?

CVE-2026-81168 has a CVSS 3.1 base score of 3.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-81168?

Yes, a patch is available for CVE-2026-81168. Update the affected software to the latest version immediately.

CAPTCHA Protected Page CVE-2026-81168

EUVD-2026-70006 LOW

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-09-02 drupal

GHSA-cxh2-vw8f-xmvf

Authentication Bypass Drupal Captcha Protected Page

3.7

CVSS 3.1 · Vendor: drupal

Severity by source

Vendor (drupal) PRIMARY

3.7 LOW

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

3.7 LOW

Network-reachable bypass with no auth needed, but high complexity and only limited page-content disclosure with no integrity or availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (drupal).

CVSS VectorVendor: drupal

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Sep 02, 2026 - 19:41 vuln.today

CVSS changed

Sep 02, 2026 - 19:22 NVD

3.7 (LOW)

Patch available

Sep 02, 2026 - 14:17 EUVD

CVE Published

Sep 02, 2026 - 12:32 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA Protected Page allows Functionality Bypass. This issue affects CAPTCHA Protected Page versions: from 0.0.0 to 1.0.2.

AnalysisAI

Authentication bypass in the Drupal CAPTCHA Protected Page contributed module (versions before 1.0.2) allows unauthenticated network attackers to access pages that should be gated behind a CAPTCHA challenge by using an alternate access path or channel that circumvents the protection logic. The confidentiality impact is limited - only the content of the CAPTCHA-protected pages is exposed, and the CVSS high-complexity rating indicates the bypass requires specific conditions to execute. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	The CAPTCHA Protected Page Drupal contributed module must be installed and actively configured to protect at least one page. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The overall real-world risk of CVE-2026-81168 is low. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Update the CAPTCHA Protected Page Drupal module to version 1.0.2 or later, which contains the vendor-released fix as documented in Drupal security advisory SA-CONTRIB-2026-105 at https://www.drupal.org/sa-contrib-2026-105. … Detailed patch versions, workarounds, and compensating controls in full report.