CVE-2026-81165: Drupal Blazy Auth Bypass Vulnerability

CVE-2026-81165 Overview

CVE-2026-81165 is an Incorrect Authorization vulnerability [CWE-863] in the Drupal Blazy module. The flaw permits Forceful Browsing, allowing unauthenticated attackers to reach resources that should require authorization checks. The issue affects Blazy versions from 0.0.0 through 3.0.18.

Blazy is a widely deployed contributed module that provides lazy-loading and media rendering for Drupal sites. The vulnerability exposes low-sensitivity information over the network without user interaction or privileges. No public exploit is currently available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
Remote attackers can bypass access controls to retrieve resources served by the Blazy module without authentication, resulting in unauthorized information disclosure.

Affected Products

Drupal Blazy module versions 0.0.0 through 3.0.18
Drupal sites with Blazy enabled for media or image lazy-loading
Any downstream distribution bundling vulnerable Blazy releases

Discovery Timeline

2026-09-02 - CVE-2026-81165 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-81165

Vulnerability Analysis

The vulnerability stems from missing or incomplete authorization checks in the Blazy module. When Blazy serves media or renders content on behalf of Drupal, it does not consistently verify that the requesting user has permission to access the underlying resource. Attackers can craft direct requests to Blazy-controlled endpoints and retrieve content that Drupal's node or entity access system would normally restrict.

The weakness is classified as Incorrect Authorization [CWE-863]. Confidentiality is affected at a low level, while integrity and availability remain unaffected. Because the attack occurs over the network with no privileges or user interaction, the vulnerability is trivially reachable on internet-facing Drupal sites running a vulnerable Blazy release.

Root Cause

The root cause is an authorization logic gap in the Blazy module. Access decisions for Blazy-served resources rely on assumptions about the referring context rather than on explicit permission checks against the entity being served. This mismatch between the enforcement point and the protected resource enables Forceful Browsing.

Attack Vector

An unauthenticated attacker sends direct HTTP requests to Blazy-controlled URLs on a target Drupal site. By enumerating identifiers or predictable paths, the attacker retrieves media or metadata that should be gated by node access rules. No credentials, tokens, or user interaction are required. Refer to the Drupal Security Advisory for module-specific technical details.

Detection Methods for CVE-2026-81165

Indicators of Compromise

Unauthenticated HTTP GET requests targeting Blazy module routes or media callbacks in web server logs.
Sequential or enumerated access patterns to entity identifiers served through Blazy.
Anonymous user sessions retrieving resources associated with restricted content types.

Detection Strategies

Inventory Drupal installations and identify sites running Blazy at version 3.0.18 or earlier.
Correlate web access logs against Drupal's node access tables to find anonymous retrievals of restricted entities.
Alert on spikes in HTTP 200 responses from Blazy endpoints to unauthenticated clients.

Monitoring Recommendations

Enable verbose access logging on the Drupal web tier and forward logs to a centralized analytics platform.
Monitor for anomalous request rates to Blazy paths from single source IP addresses.
Track changes to Blazy module versions across the estate to confirm patch adoption.

How to Mitigate CVE-2026-81165

Immediate Actions Required

Upgrade the Drupal Blazy module to a fixed release above 3.0.18 as identified in the vendor advisory.
Audit web server access logs for prior unauthorized retrievals of restricted media served through Blazy.
Review Drupal permission assignments for anonymous and authenticated roles to reduce exposed content surface.

Patch Information

Drupal has published remediation guidance in the Drupal Security Advisory. Site operators should update Blazy using Composer or the Drupal update workflow and clear caches after the upgrade. Verify the installed version through the Drupal administrative reports page.

Workarounds

Restrict access to Blazy-served paths at the reverse proxy or web application firewall until the module is patched.
Temporarily disable the Blazy module on sites hosting sensitive restricted content if patching is delayed.
Enforce authenticated-only access to media directories using web server access controls.

bash

# Update Blazy to the fixed release using Composer
composer update drupal/blazy --with-dependencies
drush updatedb
drush cache:rebuild