{"id":"CVE-2026-87955","kind":"vulnerability","aliases":["CVE-2026-87955"],"related":[],"title":"Drupal Ultimate Table Field: missing access check allows forceful browsing","description":"Missing Authorization vulnerability in Drupal Ultimate Table Field allows Forceful Browsing. This issue affects Ultimate Table Field versions: from 0.0.0 to 1.1.1, from 2.0.0 to 2.0.1.","summary":"The Drupal Ultimate Table Field module lacks an authorization check, so users can reach content they should not see by requesting URLs directly. The sources do not describe the exact data exposed.","severity":"medium","cvss":4.3,"epss":0.00193,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","php","self-hosted"],"not_affected_if":["module-not-installed"],"how_to_check":"- Look for the module in the Drupal project: `composer show drupal/ultimate_table_field` and confirm the version.\n- Check whether the installed version falls in the affected ranges: `0.0.0` to `1.1.1`, or `2.0.0` to `2.0.1`.","fix":"- Upgrade `drupal/ultimate_table_field` to a version newer than `2.0.1` or `1.1.1`, whichever line you use; the sources do not name the exact fixed release.","status":"open","published_at":"2026-10-22T02:17:05+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:37:29+00:00","updated_at":"2026-10-25T04:37:29+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T04:37:29Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `drupal/ultimate_table_field` to a version newer than `2.0.1` or `1.1.1`, whichever line you use; the sources do not name the exact fixed release.","reach":"internet","title":"Drupal Ultimate Table Field: missing access check allows forceful browsing","impact":"low","summary":"The Drupal Ultimate Table Field module lacks an authorization check, so users can reach content they should not see by requesting URLs directly. The sources do not describe the exact data exposed.","category":"package","nicknames":[],"who_cares":["drupal","php","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unauthorized users read table field content they should not reach","analyst_note":"Check the NVD entry and the Drupal security advisory for the fixed version and which access paths are affected.","how_to_check":"- Look for the module in the Drupal project: `composer show drupal/ultimate_table_field` and confirm the version.\n- Check whether the installed version falls in the affected ranges: `0.0.0` to `1.1.1`, or `2.0.0` to `2.0.1`.","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Sites running the Ultimate Table Field module in the affected version ranges are exposed, most likely where table field content is shown to users who should not see it. Sites that do not use this module can skip it. The sources do not say which access paths are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000604,"input_tokens":3342,"output_tokens":540,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-87955':13A,16A '0.0.0':74C '1.1.1':76C '2.0.0':78C '2.0.1':80C 'access':6A 'affect':68C 'allow':8A,63C 'author':31B,56C 'brows':10A,65C 'check':7A,32B 'content':37B 'cve':11A,14A 'data':53B 'describ':50B 'direct':45B 'drupal':1A,17B,24B,59C 'exact':52B 'expos':54B 'field':4A,27B,62C,71C 'forc':9A,64C 'host':22B 'issu':67C 'lack':29B 'miss':5A,55C 'modul':28B 'packag':18B 'php':19B 'reach':36B 'request':43B 'see':41B 'self':21B 'self-host':20B 'sourc':47B 'tabl':3A,26B,61C,70C 'ultim':2A,25B,60C,69C 'url':44B 'user':34B 'version':72C 'vulner':57C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Ultimate Table Field module in the affected version ranges are exposed, most likely where table field content is shown to users who should not see it. Sites that do not use this module can skip it. The sources do not say which access paths are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:17:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87955","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87955","severity":null,"published_at":"2026-10-22T02:17:05+00:00","modified_at":"2026-10-22T16:19:39+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-87955","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87955","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}