Drupal Data field CVE-2026-81269

No authentication is required - the CVSS vector PR:N confirms unauthenticated exploitation. The Drupal site must have the Data field contributed module installed and enabled, running a version in the range 0.0.0 to 2.0.13. Exploitation is limited to confidentiality impact only (C:L); no write or destructive capability is exposed. Sites that do not install this contributed module are entirely unaffected. The data exposed is limited to whatever content is stored in Data field-typed fields; sites not storing sensitive data in those fields face negligible practical impact.

The CVSS 3.1 base score of 5.3 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N reflects a medium-severity information disclosure. The low complexity and no-privilege-required rating mean exploitation is straightforward and automatable against any exposed Drupal instance running the affected module. However, the impact is bounded: only confidentiality is affected, and only at a low level (C:L), suggesting partial or limited data exposure rather than wholesale database access. No EPSS data was provided, no KEV listing exists, and no public proof-of-concept has been identified, all consistent with a low-urgency advisory. The 'Authentication Bypass' tag in the metadata is a mislabel - CWE-862 is Missing Authorization, a distinct class. Real-world risk depends on whether the exposed field data contains sensitive content; sites storing PII or confidential content in Data field entities carry higher practical risk than those using it for generic structured data.

An unauthenticated attacker who knows or can enumerate the URL pattern for Drupal Data field content sends direct HTTP GET requests to those endpoints. Because the module omits the authorization check, the server returns field data without verifying the requester's permissions. No exploit code or specialized tooling is required beyond a standard HTTP client.