Live › vulnerability › CVE-2026-118583
Drupal's Field Permissions module has an incorrect authorization flaw that lets a visitor reach content they should not see by browsing directly to it. The sources do not state what data is exposed beyond that.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Drupal sites that run the Field Permissions module at version 1.6.0 or earlier and use it to restrict access to fields. Sites without this module, or with it on a later version, are not affected. The sources do not say whether anonymous access is enough to exploit it.
No product ranges from the sources yet.
drush pm:list --filter=field_permissions or by reading composer.lock for drupal/field_permissions.1.6.0. The sources do not name the exact fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-118583")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.