Description

Incorrect Authorization vulnerability in Drupal Blazy allows Forceful Browsing. This issue affects Blazy versions: from 0.0.0 to 3.0.18.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-02T13:18:12.247Z",
  "pubdate": "2026-09-02T13:18:12.247Z",
  "executiveSummary": "The Drupal Blazy module is susceptible to an Incorrect Authorization vulnerability that facilitates Forceful Browsing attacks. This security flaw allows unauthenticated or unauthorized remote actors to bypass access controls, potentially accessing sensitive resources or performing unauthorized operations within the affected component. The vulnerability impacts Blazy versions 0.0.0 through 3.0.18. By manipulating resource requests, an attacker can navigate to restricted paths that should be protected by Drupal's access management system, thereby undermining the module's internal security perimeter. The risk implications include unauthorized data exposure and the potential for lateral movement within the application framework. Exploitation requires no advanced credentials, as the vulnerability resides in the core authorization logic of the module, allowing for direct interaction with private endpoints or sensitive data structures that were intended to be hidden from the public-facing interface.",
  "technicalDetails": "The vulnerability originates from a failure in the Blazy module's authorization layer, specifically within the access control verification process. In Drupal, access control is typically enforced by checking the permissions of the current user session against defined routing requirements. In affected versions of Blazy (0.0.0 through 3.0.18), the routing configuration or the controller-level access callbacks fail to properly validate user credentials or permissions before serving requested content or executing specific functions.\nForceful Browsing, also known as forced browsing or hidden directory discovery, leverages this lack of server-side validation. An attacker can systematically identify or guess the URL structure of the Blazy module's restricted endpoints. Because the module does not perform an adequate 'access check' during the dispatch process, the Drupal request cycle proceeds to execute the requested controller method regardless of the user's privilege level. This allows an actor to bypass the intended security constraints of the application.\nThe attack flow proceeds as follows: First, the attacker performs reconnaissance to identify the endpoint patterns used by the Blazy module. Second, the attacker issues crafted HTTP requests to these sensitive, theoretically restricted URLs. Third, due to the missing access control logic, the Drupal application processes the request, assuming the caller has already been validated. Finally, the server returns the requested restricted data or executes the invoked module function, resulting in the successful exfiltration of sensitive information or the unauthorized use of module features. The lack of strict authorization checks on controller routing prevents the Drupal Kernel from blocking these unauthorized requests effectively. This vulnerability does not require prior knowledge of legitimate user accounts; it is essentially a design flaw in how the module manages its internal API and access restrictions during the routing lifecycle, rendering traditional permission-based security controls ineffective for these specific paths."
}