What is the CVSS score of CVE-2026-81269?

CVE-2026-81269 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-81269?

Yes, a patch is available for CVE-2026-81269. Update the affected software to the latest version immediately.

Drupal Data field CVE-2026-81269

EUVD-2026-70003 MEDIUM

Missing Authorization (CWE-862)

2026-09-02 drupal

GHSA-rq35-w8f7-p43g

Drupal Data Field

5.3

CVSS 3.1 · Vendor: drupal

Severity by source

Vendor (drupal) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Unauthenticated network access with no complexity; impact is confidentiality-only at low level, no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (drupal).

CVSS VectorVendor: drupal

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Metadata Corrected

Sep 02, 2026 - 20:40 vuln.today

tag: Authentication Bypass removed

Analysis Generated

Sep 02, 2026 - 19:42 vuln.today

CVSS changed

Sep 02, 2026 - 19:22 NVD

5.3 (MEDIUM)

Patch available

Sep 02, 2026 - 14:17 EUVD

CVE Published

Sep 02, 2026 - 12:32 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Missing Authorization vulnerability in Drupal Data field allows Forceful Browsing. This issue affects Data field versions: from 0.0.0 to 2.0.13.

AnalysisAI

Forceful browsing via missing authorization in the Drupal Data field contributed module (versions up to 2.0.13) exposes field data to unauthenticated network access. The module fails to enforce access control checks before serving field content, allowing an attacker to directly request protected data resources by crafting or guessing their URLs. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	No authentication is required - the CVSS vector PR:N confirms unauthenticated exploitation. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score of 5.3 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N reflects a medium-severity information disclosure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade the Drupal Data field module to version 2.0.13 or later, which contains the vendor-released authorization fix. … Detailed patch versions, workarounds, and compensating controls in full report.