EUVD-2026-70000
GHSA-3wf5-7hjw-48cg
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-accessible, no auth or interaction needed; only limited confidentiality impact from read-only entity disclosure; no integrity or availability effect.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
5DescriptionCVE.org
Incorrect Authorization vulnerability in Drupal Entity API allows Forceful Browsing. This issue affects Entity API versions: from 0.0.0 to 1.8.0.
AnalysisAI
Incorrect authorization in the Drupal Entity API contributed module (versions prior to 1.8.0) enables forceful browsing, allowing unauthenticated remote attackers to access restricted entity resources by directly requesting entity URLs that bypass access control checks. All Drupal installations running Entity API 0.0.0 through 1.7.x are affected; a patched release (1.8.0) has been issued by Drupal security. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The Drupal Entity API contributed module must be installed and enabled at a version between 0.0.0 and 1.7.x (inclusive). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N scores 5.3 (Medium), reflecting a network-accessible, unauthenticated flaw with low complexity and limited confidentiality impact only - no integrity or availability dimensions apply. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Drupal Entity API module to version 1.8.0 or later, which contains the authorization fix per SA-CONTRIB-2026-113 at https://www.drupal.org/sa-contrib-2026-113. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Entity Api
View allThe Entity API module 7.x-1.x before 7.x-1.2 for Drupal, when using the (a) Views field or (b) area plugins, allows remo
The Entity API module 7.x-1.x before 7.x-1.2 for Drupal does not properly restrict access to node comments, which allows
Cross-site scripting (XSS) vulnerability in the Entity API module before 7.x-1.6 for Drupal allows remote authenticated
Same weakness CWE-863 – Incorrect Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today