Threats tagged 'drupal-contrib-2026-288'

The Drupal module 'field_permissions' before version 1.6.0 has insufficient verification of administrative privileges when checking access to protected fields. This flaw can allow users assigned a role named 'administrator'—if that role is not flagged as the site's official administrator role—to bypass field-level access restrictions and gain unauthorized view and edit access to protected fields. Sites using Drupal's default administrator role configuration are not affected. A fix is available in version 1.6.0.