1 line
1.3 KiB
JSON
1 line
1.3 KiB
JSON
{"schema_version":"1.9.0","id":"DRUPAL-CONTRIB-2026-113","published":"2026-08-26T17:41:31Z","modified":"2026-08-28T12:32:58Z","aliases":["CVE-2026-81158"],"details":"The Entity API module extends the Drupal core entity API to provide a unified way to deal with entities and their properties.\n\nThe module doesn't correctly apply access controls for JSON:API entity collection endpoints. This exposes an information disclosure vulnerability.\n\nThis vulnerability is mitigated by the fact that the JSON:API module must be enabled in combination with the Entity API module.","affected":[{"package":{"name":"drupal/entity","ecosystem":"Packagist:https://packages.drupal.org/8","purl":"pkg:composer/drupal/entity?repository_url=https:%2F%2Fpackages.drupal.org%2F8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0"}],"database_specific":{"constraint":"<1.8.0"}}],"database_specific":{"affected_versions":"<1.8.0","source":"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/entity/DRUPAL-CONTRIB-2026-113.json"}}],"references":[{"type":"WEB","url":"https://www.drupal.org/sa-contrib-2026-113"}],"credits":[{"name":"Douglas Groene (dgroene)","contact":["https://www.drupal.org/u/dgroene"]},{"name":"Matt Glaman (mglaman)","contact":["https://www.drupal.org/u/mglaman"]}]} |