SA-CONTRIB-2026-113: Critical severity drupal/entity vulnerability
Published Aug 26, 2026
·Updated
The Entity API module extends the Drupal core entity API to provide a unified way to deal with entities and their properties. The module doesn't correctly apply access controls for JSON:API entity collection endpoints. This exposes an information disclosure vulnerability. This vulnerability is mitigated by the fact that the JSON:API module must be enabled in combination with the Entity API module.
Credit
Douglas Groene (dgroene), Matt Glaman (mglaman)
Affected Software
1 affected componentFixes available
drupal/entity<8.x-1.8
8.x-1.8
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/entityto a version that resolves this vulnerability.Fixed in 8.x-1.8
Event History
Aug 26, 2026
Advisory Published
via Drupal·12:00 AM
Data Sourced
via Drupal·12:00 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
How can I quickly determine whether a Drupal site is potentially exposed?
The site must have both the Entity API module and the JSON:API module enabled. Sites without that module combination are not affected by the condition described.