CVE-2026-81165

Drupal Blazy (a Drupal contrib module) has an incorrect authorization vulnerability that allows forceful browsing . The module's Filter plugin shortcode does not consistently check entity view access, enabling a user with access to a Blazy-enabled text format to render a field from an entity they...