{"id":"CVE-2026-118583","kind":"vulnerability","aliases":["CVE-2026-118583"],"related":[],"title":"Drupal Field Permissions: incorrect authorization allows forceful browsing of fields","description":"Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0.","summary":"Drupal's Field Permissions module has an incorrect authorization flaw that lets a visitor reach content they should not see by browsing directly to it. The sources do not state what data is exposed beyond that.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","field-permissions","package","self-hosted"],"not_affected_if":["module-not-installed","version-above-1.6.0"],"how_to_check":"- Check the installed Field Permissions version with `drush pm:list --filter=field_permissions` or by reading composer.lock for `drupal/field_permissions`.\n- Confirm whether the site uses field-level permissions on sensitive fields.","fix":"- Field Permissions versions from 0.0.0 to 1.6.0 are affected; move to a version later than `1.6.0`. The sources do not name the exact fixed version.","status":"open","published_at":"2026-10-30T04:18:24+00:00","first_seen_at":"2026-10-30T04:28:39+00:00","triaged_at":"2026-10-30T04:29:00+00:00","updated_at":"2026-10-30T04:29:00+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-30T04:29:00Z","model":"claude-haiku-5-5","output":{"fix":"- Field Permissions versions from 0.0.0 to 1.6.0 are affected; move to a version later than `1.6.0`. The sources do not name the exact fixed version.","reach":"internet","title":"Drupal Field Permissions: incorrect authorization allows forceful browsing of fields","impact":"medium","summary":"Drupal's Field Permissions module has an incorrect authorization flaw that lets a visitor reach content they should not see by browsing directly to it. The sources do not state what data is exposed beyond that.","audience":"businesses","category":"package","nicknames":[],"who_cares":["drupal","field-permissions","self-hosted"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized visitors read restricted field content on the site","analyst_note":"Check the Drupal security advisory for the fixed version, the exact scope of exposed fields, and whether authentication is required; the NVD entry gives none of these.","how_to_check":"- Check the installed Field Permissions version with `drush pm:list --filter=field_permissions` or by reading composer.lock for `drupal/field_permissions`.\n- Confirm whether the site uses field-level permissions on sensitive fields.","plain_action":"","needs_analyst":true,"not_affected_if":["module-not-installed","version-above-1.6.0"],"who_is_affected":"Drupal sites that run the Field Permissions module at version 1.6.0 or earlier and use it to restrict access to fields. Sites without this module, or with it on a later version, are not affected. The sources do not say whether anonymous access is enough to exploit it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000708,"input_tokens":4081,"output_tokens":600,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118583':13A,16A '-2026':12A,15A '0.0.0':77C '1.6.0':79C 'affect':72C 'allow':6A,67C 'author':5A,33B,61C 'beyond':59B 'brows':8A,46B,69C 'content':40B 'cve':11A,14A 'data':56B 'direct':47B 'drupal':1A,17B,25B,64C 'expos':58B 'field':2A,10A,19B,27B,65C,73C 'field-permiss':18B 'flaw':34B 'forc':7A,68C 'host':24B 'incorrect':4A,32B,60C 'issu':71C 'let':36B 'modul':29B 'packag':21B 'permiss':3A,20B,28B,66C,74C 'reach':39B 'see':44B 'self':23B 'self-host':22B 'sourc':51B 'state':54B 'version':75C 'visitor':38B 'vulner':62C","nicknames":[],"mitigations":[],"who_affected":"Drupal sites that run the Field Permissions module at version 1.6.0 or earlier and use it to restrict access to fields. Sites without this module, or with it on a later version, are not affected. The sources do not say whether anonymous access is enough to exploit it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:18:24+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118583","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118583","severity":null,"published_at":"2026-10-30T04:18:24+00:00","modified_at":"2026-10-30T04:18:24+00:00","first_seen_at":"2026-10-30T04:28:39+00:00","fetched_at":"2026-10-30T04:28:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}