Executive brief
Drupal Blazy is a lazy-loading and media optimization module used to improve website performance by deferring the loading of off-screen images and media. A flaw in the module's filter shortcode allows users with access to Blazy-enabled text formats to view fields from entities they do not have permission to access, potentially exposing restricted content.
Technical details
The vulnerability is an access control bypass in the Blazy Filter plugin shortcode. The module fails to consistently check entity view access before rendering fields through the shortcode, allowing a user with access to a Blazy-enabled text format to bypass authorization and display fields from entities they are not permitted to view. The impact is mitigated by the fact that only fields the shortcode can render are exposed—the entire entity is not disclosed. Attack vector requires user interaction (writing content with the shortcode) and formatter access. The vulnerability affects Blazy versions prior to 3.0.18, and patches are available in the latest release.
Affected products
- Drupal Blazy 0.0.0 to 3.0.18
Timeline
- 2026-08-26: disclosed
- 2026-08-26: patched: Patch available in Blazy 3.0.18 and later