CVE-2026-81158: Drupal Entity API Auth Bypass Vulnerability

CVE-2026-81158 Overview

CVE-2026-81158 is an Incorrect Authorization vulnerability [CWE-863] in the Drupal Entity API contributed module. The flaw allows forceful browsing, enabling unauthenticated remote attackers to access resources that should be protected by access control checks. The issue affects Entity API versions 0.0.0 through 1.8.0. Because the attack vector is network-based and requires no privileges or user interaction, any exposed Drupal site running an affected version of the module is reachable by anonymous attackers. Confidentiality impact is limited to information the module fails to gate correctly, with no direct impact to integrity or availability.

Critical Impact
Unauthenticated attackers can bypass authorization checks in Drupal Entity API <= 1.8.0 and read entity data through forceful browsing.

Affected Products

Drupal Entity API module versions 0.0.0 through 1.8.0
Drupal sites with the contributed Entity API module enabled
Any Drupal deployment exposing entity endpoints managed by the affected module

Discovery Timeline

2026-09-02 - CVE-2026-81158 published to NVD
2026-09-02 - Last updated in NVD database
Drupal Security Advisory SA-CONTRIB-2026-113 - Vendor advisory published (Drupal Security Advisory #2026-113)

Technical Details for CVE-2026-81158

Vulnerability Analysis

The Entity API module fails to enforce authorization consistently across all entity access paths. This class of flaw, categorized as Incorrect Authorization [CWE-863], occurs when the application performs an authorization check but the check does not correctly cover every route or operation that exposes protected data. Attackers exploit the gap through forceful browsing, requesting URLs or endpoints directly instead of following the intended navigation flow.

Because Drupal Entity API is a foundational module used by many contributed modules to expose and manage entities, any downstream module depending on it for access control may inherit the weakness. The result is unauthorized read access to entity data that the site owner intended to restrict.

Root Cause

The root cause is a missing or incomplete access check within the Entity API code paths that resolve entity requests. Authorization logic exists but does not evaluate all conditions required to deny anonymous or lower-privileged users. Refer to the Drupal Security Advisory #2026-113 for the specific code paths corrected in the fix.

Attack Vector

An attacker sends direct HTTP requests to entity URLs or API endpoints exposed by the module. No authentication, session, or user interaction is required. The attacker enumerates entity identifiers and retrieves data that the site's access policy should have blocked. Successful exploitation returns entity content in the HTTP response body, which the attacker can harvest at scale.

No verified exploit code is publicly available. See the vendor advisory for technical details on the affected request paths.

Detection Methods for CVE-2026-81158

Indicators of Compromise

Anonymous HTTP requests to entity endpoints returning 200 OK responses containing entity field data
Sequential enumeration patterns against entity identifier parameters in web server access logs
Unusual volumes of requests from a single source targeting Entity API-backed routes

Detection Strategies

Inventory Drupal sites and identify installations of the Entity API contributed module at or below version 1.8.0
Compare authenticated versus anonymous response payloads for identical entity URLs to detect authorization drift
Review web application firewall logs for forceful-browsing patterns targeting /entity/, /node/, and REST endpoints

Monitoring Recommendations

Alert on spikes in anonymous access to entity or API routes previously restricted to authenticated roles
Track HTTP 200 responses to unauthenticated requests carrying entity payloads larger than expected error responses
Correlate access log anomalies with Drupal watchdog entries for access denied events that fail to fire

How to Mitigate CVE-2026-81158

Immediate Actions Required

Upgrade the Drupal Entity API module to a version later than 1.8.0 as directed in Drupal Security Advisory #2026-113
Audit anonymous role permissions and remove any grants that assume the module enforces authorization
Review recent access logs for forceful-browsing indicators to determine if data has already been exposed

Patch Information

Drupal has issued a fixed release of the Entity API module. Apply the update referenced in the Drupal Security Advisory #2026-113. Sites using Composer should update the module through composer update drupal/entity and clear caches with drush cr after deployment.

Workarounds

Restrict access to entity endpoints at the reverse proxy or web application firewall until the module is updated
Disable the Entity API module on sites where it is not required by installed contributed modules
Enforce authentication on affected paths through Drupal's access control configuration where feasible

bash

# Update the Entity API module and clear Drupal caches
composer update drupal/entity --with-dependencies
drush updatedb -y
drush cache:rebuild