---
id: "CVE-2026-118584"
kind: "vulnerability"
aliases: ["CVE-2026-118584"]
title: "Drupal Field Permissions: incorrect authorization allows forceful browsing of fields"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["drupal", "package", "php", "self-hosted"]
not_affected_if: ["module-not-installed"]
published_at: "2026-10-30T04:18:24+00:00"
first_seen_at: "2026-10-30T04:28:39+00:00"
updated_at: "2026-10-30T04:28:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118584", "first_seen_at": "2026-10-30T04:28:39+00:00"}]
---

# Drupal Field Permissions: incorrect authorization allows forceful browsing of fields

Drupal Field Permissions versions 0.0.0 through 1.6.0 contain an incorrect authorization flaw. The sources say it allows forceful browsing, so an attacker can reach content they should not see.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Field Permissions module version in the Drupal project (for example with `composer show drupal/field_permissions` or the Extend page in the admin UI).
- Confirm whether the site uses the Field Permissions module at all.

## Fix

- Field Permissions versions up to and including `1.6.0` are affected; the sources do not name a fixed version.

## Timeline

- 2026-10-30T04:28:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118584

## From the sources

Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_