CVE-2026-81158

The Entity API module for Drupal (versions 0.0.0 through 1.8.0 ) contains an incorrect authorization vulnerability that enables forceful browsing . The root cause is the module's failure to correctly apply access controls for JSON:API entity collection endpoints , which results in information dis...