CVE-2026-81165 in Blazy Module
Summary
by MITRE • 09/02/2026
Incorrect Authorization vulnerability in Drupal Blazy allows Forceful Browsing. This issue affects Blazy versions: from 0.0.0 to 3.0.18.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/02/2026
The identified security flaw within the Drupal module known as Blazy represents a critical failure in access control mechanisms, specifically categorized under CWE-284 Improper Access Control and mapped to MITRE ATT&CK technique T1078 Valid Accounts if exploited by authenticated users or potentially T1528 Steal Application Access Token depending on the specific authentication context. This vulnerability manifests as an instance of forceful browsing, where an attacker can bypass intended authorization checks to access resources that should be restricted based on user roles or permissions. The root cause lies in the module's handling of requests related to image styles and lazy loading configurations, which fail to adequately verify whether the requesting entity possesses the necessary privileges before serving sensitive data or executing administrative functions. This oversight allows unauthorized entities to interact with internal APIs or retrieve configuration details that are not meant for public consumption, thereby undermining the integrity of the content management system's security model.
The operational impact of this vulnerability is significant as it enables attackers to perform reconnaissance and potentially escalate their privileges within the Drupal environment. By exploiting the incorrect authorization logic in Blazy versions ranging from 0.0.0 through 3.0.18, an attacker can enumerate site structures, access private image files, or manipulate lazy loading parameters that may lead to further exploitation vectors such as cross-site scripting if input validation is also compromised elsewhere in the pipeline. The ability to force browse restricted resources compromises confidentiality and integrity, allowing malicious actors to gather intelligence about the website's architecture, user roles, and content organization. This information can be leveraged for targeted attacks against specific users or administrative accounts, potentially leading to full site compromise when combined with other vulnerabilities like SQL injection or remote code execution flaws that may exist in related modules.
Mitigation strategies must focus on immediate remediation through software updates and rigorous access control auditing. The primary recommendation is to upgrade the Blazy module to a version later than 3.0.18, where these authorization checks have been corrected by the maintainers to enforce proper permission validation before processing requests. For organizations unable to update immediately due to compatibility constraints with other modules or custom code, implementing web application firewall rules can provide temporary protection by blocking known exploit patterns associated with forceful browsing attempts on Blazy endpoints. Additionally, security teams should conduct a thorough review of all Drupal modules for similar authorization flaws, ensuring that every endpoint verifies user roles against the requested action according to the principle of least privilege. Regular penetration testing and code reviews focusing on access control logic are essential to prevent recurrence and maintain a robust defense-in-depth posture against unauthorized access attempts.