Live › vulnerability › CVE-2026-87955
Go to dashboardThe Drupal Ultimate Table Field module lacks an authorization check, so users can reach content they should not see by requesting URLs directly. The sources do not describe the exact data exposed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Ultimate Table Field module in the affected version ranges are exposed, most likely where table field content is shown to users who should not see it. Sites that do not use this module can skip it. The sources do not say which access paths are affected.
No product ranges from the sources yet.
composer show drupal/ultimate_table_field and confirm the version.0.0.0 to 1.1.1, or 2.0.0 to 2.0.1.drupal/ultimate_table_field to a version newer than 2.0.1 or 1.1.1, whichever line you use; the sources do not name the exact fixed release.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in Drupal Ultimate Table Field allows Forceful Browsing. This issue affects Ultimate Table Field versions: from 0.0.0 to 1.1.1, from 2.0.0 to 2.0.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-87955")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.