Executive brief
Drupal's Entity API module extends Drupal's core entity management system, which many websites rely on to organize and manage content. When combined with the JSON:API module, a flaw in access control allows attackers to bypass authorization checks and access sensitive entity information that should be restricted. This could expose confidential data to unauthorized users without requiring authentication.
Technical details
The Entity API module fails to correctly apply access controls on JSON:API entity collection endpoints, resulting in an information disclosure vulnerability. The vulnerable component is the JSON:API integration layer within the Entity API module; the root cause is improper authorization validation when serving entity data through JSON:API endpoints. The vulnerability requires the JSON:API module to be enabled alongside Entity API and is reachable over the network without authentication. An attacker can browse entity collections and retrieve restricted information that should be gated by access control checks. The vulnerability has been patched in Entity API 8.x-1.8 (released 2026-08-26); affected installations must upgrade immediately.
Affected products
- Drupal Entity API < 1.8.0
Timeline
- 2026-08-26: disclosed: Security advisory SA-CONTRIB-2026-113 published
- 2026-08-26: patched: Entity API 8.x-1.8 released with fix