Blazy
Monthly
Incorrect authorization enforcement in Drupal's Blazy lazy-loading module (all versions before 3.0.18) enables unauthenticated remote users to perform forceful browsing - directly requesting URLs of media assets that Drupal's access controls are intended to restrict. The module fails to apply proper authorization checks when serving lazily-loaded resources, exposing low-level confidentiality impact (C:L) with no integrity or availability consequence. No active exploitation has been confirmed and no public proof-of-concept has been identified; a vendor patch is available at version 3.0.18 per advisory SA-CONTRIB-2026-104.
Incorrect authorization enforcement in Drupal's Blazy lazy-loading module (all versions before 3.0.18) enables unauthenticated remote users to perform forceful browsing - directly requesting URLs of media assets that Drupal's access controls are intended to restrict. The module fails to apply proper authorization checks when serving lazily-loaded resources, exposing low-level confidentiality impact (C:L) with no integrity or availability consequence. No active exploitation has been confirmed and no public proof-of-concept has been identified; a vendor patch is available at version 3.0.18 per advisory SA-CONTRIB-2026-104.