Live › vulnerability › CVE-2026-118584
Drupal Field Permissions versions 0.0.0 through 1.6.0 contain an incorrect authorization flaw. The sources say it allows forceful browsing, so an attacker can reach content they should not see.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Drupal sites that run the Field Permissions module, which controls who can view or edit individual fields. Sites that do not install this module are not affected. The sources do not say which configurations or roles are needed to reach the flaw.
No product ranges from the sources yet.
composer show drupal/field_permissions or the Extend page in the admin UI).1.6.0 are affected; the sources do not name a fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-118584")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.