Description

Incorrect Authorization vulnerability in Drupal Entity API allows Forceful Browsing. This issue affects Entity API versions: from 0.0.0 to 1.8.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-02T13:18:11.540Z",
  "pubdate": "2026-09-02T13:18:11.540Z",
  "executiveSummary": "The Drupal Entity API is susceptible to an Incorrect Authorization vulnerability that facilitates Forceful Browsing attacks. This flaw originates from improper access control enforcement within the API's entity handling logic, allowing unauthorized actors to access or interact with entities that should otherwise be restricted. Affected versions include all releases from 0.0.0 through 1.8.0.\nThe vulnerability poses a significant security risk by permitting remote attackers to bypass established authorization checks. Successful exploitation enables unauthorized retrieval of sensitive data or the performance of administrative actions by requesting specific URLs or endpoints that the user lacks the privileges to access. This effectively undermines the integrity and confidentiality of the Drupal installation. The attack requires no specialized capabilities beyond the ability to craft HTTP requests targeting valid, yet restricted, entity paths. Consequently, any deployment utilizing the vulnerable Entity API version is at risk of unauthorized information disclosure and potential privilege escalation through forced navigation.",
  "technicalDetails": "The vulnerability resides in the core authorization logic of the Drupal Entity API, which fails to correctly validate user permissions when processing requests for entity operations. In a standard Drupal environment, the Entity API is responsible for providing a unified interface for interacting with various entity types. The flaw manifests when the API logic relies on insufficient or bypassed access callbacks during the routing or request handling process.\nThe root cause is an improper authorization check that does not adequately verify the requester's access rights before granting access to sensitive entity resources. When an attacker performs 'Forceful Browsing,' they manually construct and send HTTP requests to specific URLs corresponding to entities—such as nodes, users, or custom entities—that are governed by the Entity API. Because the API fails to enforce appropriate access controls, the system mistakenly honors these requests, assuming that access has been validated at an earlier stage or that the endpoint is publicly accessible.\nThe attack flow proceeds as follows: First, the attacker identifies a target entity URL or endpoint handled by the Entity API. Second, the attacker interacts directly with these paths. Third, instead of the API performing a granular check against the current user's session or role-based access control (RBAC) settings, the internal logic proceeds to execute the requested operation. This allows the attacker to view, modify, or delete data based on the specific capabilities of the targeted entity operation, even if the authenticated session or anonymous user profile lacks the necessary permissions.\nThe exposure is strictly related to the server-side validation logic within the Entity API module. Since this occurs at the API layer, it bypasses standard UI-based restrictions that would typically hide these endpoints from unauthorized users. The vulnerability impacts all versions from 0.0.0 to 1.8.0. The post-exploitation impact is severe, potentially leading to unauthorized data harvesting (Information Disclosure) or unauthorized modification of site content, depending on the nature of the entity and the actions permitted by the API for that entity type. Exploitation does not require complex payloads, only the knowledge of the URI structure used by the Drupal Entity API."
}