CVE-2026-18985: CWE-863 Incorrect Authorization in Drupal Edit in-place field

This vulnerability (CVE-2026-18985) in the Drupal Edit in-place field module is classified under CWE-863 (Incorrect Authorization) and CWE-285 (Improper Authorization). It enables forceful browsing attacks by failing to properly enforce authorization controls, allowing attackers with some level of privileges to access or modify resources they should not be authorized to. The affected versions include all versions from 0.0.0 up to 2.1.1. The CVSS 3.1 base score is 8.1, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality and integrity. As of the published date, no vendor advisory or patch is available, and no known exploits are reported in the wild.

Successful exploitation can lead to unauthorized access and modification of data within the Drupal Edit in-place field module, compromising confidentiality and integrity. The vulnerability does not affect availability. The high CVSS score reflects the potential for significant unauthorized data exposure or alteration without user interaction and with low attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected module and monitor for unusual access patterns. Avoid granting unnecessary privileges to users who can interact with the Edit in-place field functionality.