Live › vulnerability › CVE-2026-77152
Field Collection for Drupal 7 grants edit and delete rights on field collection items to anyone with the 'edit field collections' permission, without checking access to the parent entity. An authenticated user with that permission can change or delete data attached to content they are not allowed to edit.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 00:32 UTC. All times on this page are UTC.
Drupal 7 sites running Field Collection versions 7.x-1.0 through 7.x-1.2 where users hold the 'edit field collections' permission. A user needs an account on the site, so sites with only anonymous or fully trusted editors face lower risk. Sites not using Field Collection are not affected.
No product ranges from the sources yet.
drush pm-list outputUnknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Authorization vulnerability in Drupal Field Collection for Drupal 7 allows a user with the "edit field collections" permission to bypass access control on the parent (host) entity.
The access check for field collection items (field_collection_item_access()) granted edit and delete access to any user holding the "edit field collections" permission without verifying the user's access to the host entity. As a result, a user with "edit field collections" but without edit/update access to the host entity (for example a node they cannot edit) could edit or delete field collection items attached to that entity, bypassing the intended entity/node access restrictions. The fix requires access to the parent entity in addition to the field collection permission.
This issue affects Field Collection for Drupal 7: version 7.x-1.0 up to and including 7.x-1.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-77152")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.