{"self":"https:\/\/www.drupal.org\/api-d7\/node?field_sa_cve=CVE-2026-81158","first":"https:\/\/www.drupal.org\/api-d7\/node?field_sa_cve=CVE-2026-81158\u0026page=0","last":"https:\/\/www.drupal.org\/api-d7\/node?field_sa_cve=CVE-2026-81158\u0026page=0","list":[{"field_issue_status":"7","field_project":{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/626176","id":"626176","resource":"node"},"field_sa_advisory_id":"113","field_sa_coordinated_by":{"value":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022\/u\/akalata\u0022 rel=\u0022nofollow\u0022\u003ESwan Kalata (akalata)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/greggles\u0022 rel=\u0022nofollow\u0022\u003EGreg Knaddison (greggles)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/larowlan\u0022 rel=\u0022nofollow\u0022\u003ELee Rowlands (larowlan)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/poker10\u0022 rel=\u0022nofollow\u0022\u003EJuraj Nemec (poker10)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/xjm\u0022 rel=\u0022nofollow\u0022\u003EJess  (xjm)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003C\/ul\u003E","format":"1"},"field_sa_criticality":"AC:Basic\/A:None\/CI:Some\/II:None\/E:Theoretical\/TD:Default","field_sa_description":{"value":"\u003Cp\u003EThe Entity API module extends the Drupal core entity API to provide a unified way to deal with entities and their properties.\u003C\/p\u003E\n\u003Cp\u003EThe module doesn\u0027t correctly apply access controls for JSON:API entity collection endpoints. This exposes an information disclosure vulnerability.\u003C\/p\u003E\n\u003Cp\u003EThis vulnerability is mitigated by the fact that the JSON:API module must be enabled in combination with the Entity API module.\u003C\/p\u003E","format":"1"},"field_sa_fixed_by":{"value":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022\/u\/berdir\u0022 rel=\u0022nofollow\u0022\u003ESascha Grossenbacher (berdir)\u003C\/a\u003E\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/klausi\u0022 rel=\u0022nofollow\u0022\u003EKlaus Purer (klausi)\u003C\/a\u003E\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/kristiaanvandeneynde\u0022 rel=\u0022nofollow\u0022\u003EKristiaan Van den Eynde (kristiaanvandeneynde)\u003C\/a\u003E\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/mglaman\u0022 rel=\u0022nofollow\u0022\u003EMatt Glaman (mglaman)\u003C\/a\u003E\n\u003C\/li\u003E\u003C\/ul\u003E","format":"1"},"field_sa_reported_by":{"value":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022\/u\/dgroene\u0022 rel=\u0022nofollow\u0022\u003EDouglas Groene (dgroene)\u003C\/a\u003E\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/mglaman\u0022 rel=\u0022nofollow\u0022\u003EMatt Glaman (mglaman)\u003C\/a\u003E\n\u003C\/li\u003E\u003C\/ul\u003E","format":"1"},"field_sa_solution":{"value":"\u003Cp\u003EInstall the latest version:\u003C\/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EIf you use the Entity API module, upgrade to \u003Ca href=\u0022https:\/\/www.drupal.org\/project\/entity\/releases\/8.x-1.8\u0022 rel=\u0022nofollow\u0022\u003EEntity API 8.x-1.8\u003C\/a\u003E.\u003C\/li\u003E\n\u003C\/ul\u003E","format":"1"},"field_sa_type":"Information disclosure","field_issue_last_status_change":"1787920378","field_sa_cve":["CVE-2026-81158"],"field_is_psa":"0","field_affected_versions":"\u003C1.8.0","field_fixed_in":[{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/3619292","id":"3619292","resource":"node"}],"nid":"3616528","vid":"14475022","is_new":false,"type":"sa","title":"Entity API - Moderately critical - Information disclosure - SA-CONTRIB-2026-113","language":"en","url":"https:\/\/www.drupal.org\/sa-contrib-2026-113","edit_url":"https:\/\/www.drupal.org\/node\/3616528\/edit","status":"1","promote":"0","sticky":"0","created":"1787766091","changed":"1787920378","author":{"uri":"https:\/\/www.drupal.org\/api-d7\/user\/406161","id":"406161","resource":"user","name":"Drupal Security Team"},"comment":"0","comments":[{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16747951","id":16747951,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16747952","id":16747952,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16747953","id":16747953,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16747954","id":16747954,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16747955","id":16747955,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16747956","id":16747956,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16747957","id":16747957,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16747960","id":16747960,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16748025","id":16748025,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16750035","id":16750035,"resource":"comment"}],"comment_count":0,"comment_count_new":false,"body":[],"feeds_item_guid":null,"feeds_item_url":null,"feed_nid":null,"flag_flag_tracker_follow_user":[],"flag_tracker_follower_count":null,"has_new_content":null,"last_comment_timestamp":"1787766091"}]}