CVE-2026-81165: Drupal Blazy Module Entity View Access Vulnerability
Summary
CVE-2026-81165: This module enables users to display a field of a target entity through a Blazy Filter plugin shortcode. Affects drupal/blazy versions < 3.0.18. Fixed in 3.0.18. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Blazy module for Drupal allows users to display fields from target entities using a Blazy Filter plugin shortcode. It is designed to enhance content rendering by enabling lazy loading of fields, improving performance and user experience. However, the module has a critical vulnerability that can expose sensitive entity fields to unauthorized users.
Vulnerability Detail
The Blazy module does not consistently enforce entity view access controls. This oversight allows users with access to a Blazy-enabled text format to render fields from entities they should not be able to view. The vulnerability is particularly concerning as it can lead to unauthorized access to sensitive information, although it is mitigated by the fact that only specific fields that the shortcode can render are affected.
How To Fix
Minimum fixed version
3.0.18
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to the Blazy-enabled text format for users who should not have access to certain entity fields. This can be done by adjusting user permissions in the Drupal admin interface.
Conclusion
The Blazy module for Drupal has a significant vulnerability (CVE-2026-81165) that can expose entity fields to unauthorized users. It is crucial to update to version 3.0.18 or later to mitigate this risk. Additionally, implementing user permission restrictions can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for drupal/blazy →
FAQ
The Blazy module is a Drupal extension that allows for lazy loading of entity fields, improving performance by loading content only when needed.
CVE-2026-81165 refers to a specific vulnerability in the Blazy module that allows unauthorized users to access entity fields they should not be able to view.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The primary risk is unauthorized access to sensitive entity fields, which could lead to data exposure and privacy concerns.
Yes, you can restrict access to the Blazy-enabled text format for users who should not have access to certain entity fields as a temporary measure.
