Most recent entries from all

DRUPAL-CONTRIB-2026-288

Affected: Packagist:https://packages.drupal.org/8: drupal/field_permissions

This module enables you to set field-level permissions to create, update or view individual fields.

The module does not sufficiently verify administrative privileges when checking access to protected fields, potentially allowing users with a role named `administrator` to bypass field-level access restrictions and gain unauthorized view and edit access to protected fields.

This vulnerability is mitigated by the fact that an attacker must have a role with the machine name `administrator` that is not flagged as the site's administrator role. Sites that use Drupal's default administrator role configuration are not affected.

fkie_cve-2026-118583

Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0.

GHSA-mx93-97v2-326w

Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0.

WID-SEC-W-2026-4230 — Drupal Erweiterungen: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um erweiterte Berechtigungen zu erlangen und Benutzerkonten zu übernehmen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren, Cross-Site-Scripting-Angriffe durchzuführen und nicht näher spezifizierte Auswirkungen zu verursachen.