EUVD-2026-70007
GHSA-gfv8-7m4v-g7m6
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-reachable forceful browsing needs no authentication or interaction; confidentiality is limited to disclosed assets only, with no integrity or availability impact.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
5DescriptionCVE.org
Incorrect Authorization vulnerability in Drupal Blazy allows Forceful Browsing. This issue affects Blazy versions: from 0.0.0 to 3.0.18.
AnalysisAI
Incorrect authorization enforcement in Drupal's Blazy lazy-loading module (all versions before 3.0.18) enables unauthenticated remote users to perform forceful browsing - directly requesting URLs of media assets that Drupal's access controls are intended to restrict. The module fails to apply proper authorization checks when serving lazily-loaded resources, exposing low-level confidentiality impact (C:L) with no integrity or availability consequence. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target Drupal site to have the Blazy module installed and enabled at a version prior to 3.0.18, and for the site to host media or file content that is intended to be access-restricted to specific roles or authenticated users. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.3 (Medium) vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N accurately characterizes a remotely exploitable but scope-limited flaw - unauthenticated network access is sufficient, but the attacker gains only low confidentiality exposure and no write or availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update Drupal Blazy to version 3.0.18 or later, the patched release identified by the EUVD affected-range boundary and referenced in SA-CONTRIB-2026-104 at https://www.drupal.org/sa-contrib-2026-104. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-863 – Incorrect Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today