CAPTCHA Protected Page EUVD-2026-70006

The CAPTCHA Protected Page Drupal contributed module must be installed and actively configured to protect at least one page. The attacker must discover or guess an alternate request path or channel that resolves to the protected content without passing through the module's CAPTCHA gate - the AC:H rating indicates this is not straightforward and likely requires site-specific knowledge, testing, or a non-obvious request pattern. Exploitation is limited exclusively to the content exposed by the CAPTCHA-protected pages; there is no integrity or availability impact confirmed by the CVSS vector. Sites that do not use this specific contributed module, or that additionally restrict protected pages via Drupal role-based access control, are not affected.

The overall real-world risk of CVE-2026-81168 is low. The CVSS base score of 3.7 reflects a constrained impact profile: the attack vector is network (AV:N) and requires no privileges (PR:N) or user interaction (UI:N), but high complexity (AC:H) limits mass exploitation - even a mid-sized municipal IT team in gniezno managing a Drupal intranet site should find that the limited C:L/I:N/A:N impact confines exposure to disclosure of page content rather than site compromise. EPSS data was not provided, and the vulnerability is absent from the CISA KEV catalog, indicating no confirmed active exploitation. No public proof-of-concept has been identified. The principal real-world risk is restricted to site operators who have specifically deployed the CAPTCHA Protected Page module to guard sensitive content from bots or unauthenticated visitors; for the vast majority of Drupal sites that do not use this module, there is zero exposure.

An attacker identifies a Drupal site using the CAPTCHA Protected Page module and, rather than solving the CAPTCHA challenge on the primary page URL, constructs a request using an alternate path or internal channel - such as a REST API route, a Drupal alias, or a non-canonical URL - that resolves to the same protected content without triggering the CAPTCHA access check. The attacker successfully retrieves the protected page content without any authentication or CAPTCHA interaction. No public proof-of-concept has been identified, and the high attack complexity suggests the bypass requires research or specific knowledge of the site's routing configuration.