{"id":"CVE-2026-118584","kind":"vulnerability","aliases":["CVE-2026-118584"],"related":[],"title":"Drupal Field Permissions: incorrect authorization allows forceful browsing of fields","description":"Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0.","summary":"Drupal Field Permissions versions 0.0.0 through 1.6.0 contain an incorrect authorization flaw. The sources say it allows forceful browsing, so an attacker can reach content they should not see.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","php","self-hosted"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed Field Permissions module version in the Drupal project (for example with `composer show drupal/field_permissions` or the Extend page in the admin UI).\n- Confirm whether the site uses the Field Permissions module at all.","fix":"- Field Permissions versions up to and including `1.6.0` are affected; the sources do not name a fixed version.","status":"open","published_at":"2026-10-30T04:18:24+00:00","first_seen_at":"2026-10-30T04:28:39+00:00","triaged_at":"2026-10-30T04:28:59+00:00","updated_at":"2026-10-30T04:28:59+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-30T04:28:59Z","model":"claude-haiku-5-5","output":{"fix":"- Field Permissions versions up to and including `1.6.0` are affected; the sources do not name a fixed version.","reach":"internet","title":"Drupal Field Permissions: incorrect authorization allows forceful browsing of fields","impact":"medium","summary":"Drupal Field Permissions versions 0.0.0 through 1.6.0 contain an incorrect authorization flaw. The sources say it allows forceful browsing, so an attacker can reach content they should not see.","audience":"businesses","category":"package","nicknames":[],"who_cares":["drupal","php","self-hosted"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown field data readable by unauthorized visitors","analyst_note":"Check the Drupal security advisory for Field Permissions and the NVD entry for a fixed version and the exact preconditions.","how_to_check":"- Check the installed Field Permissions module version in the Drupal project (for example with `composer show drupal/field_permissions` or the Extend page in the admin UI).\n- Confirm whether the site uses the Field Permissions module at all.","plain_action":"","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Drupal sites that run the Field Permissions module, which controls who can view or edit individual fields. Sites that do not install this module are not affected. The sources do not say which configurations or roles are needed to reach the flaw.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000679,"input_tokens":4081,"output_tokens":542,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118584':13A,16A '-2026':12A,15A '0.0.0':27B,69C '1.6.0':29B,71C 'affect':64C 'allow':6A,39B,59C 'attack':44B 'author':5A,33B,53C 'brows':8A,41B,61C 'contain':30B 'content':47B 'cve':11A,14A 'drupal':1A,17B,23B,56C 'field':2A,10A,24B,57C,65C 'flaw':34B 'forc':7A,40B,60C 'host':22B 'incorrect':4A,32B,52C 'issu':63C 'packag':18B 'permiss':3A,25B,58C,66C 'php':19B 'reach':46B 'say':37B 'see':51B 'self':21B 'self-host':20B 'sourc':36B 'version':26B,67C 'vulner':54C","nicknames":[],"mitigations":[],"who_affected":"Drupal sites that run the Field Permissions module, which controls who can view or edit individual fields. Sites that do not install this module are not affected. The sources do not say which configurations or roles are needed to reach the flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:18:24+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118584","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118584","severity":null,"published_at":"2026-10-30T04:18:24+00:00","modified_at":"2026-10-30T04:18:24+00:00","first_seen_at":"2026-10-30T04:28:39+00:00","fetched_at":"2026-10-30T04:28:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}