CVE-2026-81162: CWE-201 Insertion of Sensitive Information Into Sent Data in Drupal DXPR Builder: The Best Editing (AI) Experience for Drupal

This vulnerability, identified as CWE-201, involves the insertion of sensitive information into data sent by the Drupal DXPR Builder module. This flaw allows an attacker to perform forceful browsing, potentially accessing unauthorized information. The affected versions include 0.0.0 through 2.8.1. The CVSS score is 5.3, indicating a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact. No vendor advisory or patch information is currently available.

The vulnerability could allow an attacker to access sensitive information by exploiting forceful browsing capabilities. The confidentiality of data may be partially compromised, but integrity and availability are not impacted according to the CVSS vector. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been published by the vendor at this time.