---
id: "CVE-2026-87955"
kind: "vulnerability"
aliases: ["CVE-2026-87955"]
title: "Drupal Ultimate Table Field: missing access check allows forceful browsing"
severity: "medium"
cvss: 4.3
epss: 0.00193
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["drupal", "package", "php", "self-hosted"]
not_affected_if: ["module-not-installed"]
published_at: "2026-10-22T02:17:05+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T04:37:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87955", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-87955", "first_seen_at": "2026-10-24T07:15:52+00:00"}]
---

# Drupal Ultimate Table Field: missing access check allows forceful browsing

The Drupal Ultimate Table Field module lacks an authorization check, so users can reach content they should not see by requesting URLs directly. The sources do not describe the exact data exposed.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look for the module in the Drupal project: `composer show drupal/ultimate_table_field` and confirm the version.
- Check whether the installed version falls in the affected ranges: `0.0.0` to `1.1.1`, or `2.0.0` to `2.0.1`.

## Fix

- Upgrade `drupal/ultimate_table_field` to a version newer than `2.0.1` or `1.1.1`, whichever line you use; the sources do not name the exact fixed release.

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-87955
- 2026-10-24T07:15:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-87955

## From the sources

Missing Authorization vulnerability in Drupal Ultimate Table Field allows Forceful Browsing. This issue affects Ultimate Table Field versions: from 0.0.0 to 1.1.1, from 2.0.0 to 2.0.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_