CVE-2026-81165: CWE-863 Incorrect Authorization in Drupal Blazy

This vulnerability (CWE-863) in the Drupal Blazy module allows unauthorized users to bypass access controls and perform forceful browsing, potentially accessing resources they should not. The affected versions include all releases from 0.0.0 through 3.0.18. The CVSS vector indicates the attack can be performed remotely without privileges or user interaction, impacting confidentiality only. There is no known exploit in the wild and no vendor-provided remediation or patch information at this time.

An attacker can remotely access restricted resources due to incorrect authorization checks, leading to limited confidentiality loss. There is no impact on integrity or availability. The vulnerability does not require user interaction or privileges to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the Blazy module or implementing additional access controls at the application or network level to mitigate unauthorized browsing.