Skip to content
OpenAdvisories
Medium · 5.3 CVE-2026-81165 DRUPAL-CONTRIB-2026-104EUVD-2026-70007GHSA-gfv8-7m4v-g7m6

Blazy - Less critical - Access bypass - SA-CONTRIB-2026-104

Published Sep 2, 2026 · Updated Sep 2, 2026 · Assigned by drupal

Vendor: Drupal Product: Blazy Package: drupal/blazy Ecosystem: Packagist

Description

Incorrect Authorization vulnerability in Drupal Blazy allows Forceful Browsing. This issue affects Blazy versions: from 0.0.0 to 3.0.18.

Affected products

VendorProductAffectedFixed
Drupal Blazy 0.0.0 – < 3.0.18 3.0.18

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist drupal/blazy < 3.0.18 3.0.18 DRUPAL-CONTRIB-2026-104

Advisories 1

References