Threats tagged 'drupal-contrib-2026-289'

The Field Permissions module for Drupal allows setting field-level permissions including a "Private" setting. A vulnerability exists where "Private" fields on entity types without an author field are not properly restricted, allowing these fields to be viewed and edited by anyone who can view the entity, including anonymous users. This issue requires that an administrator has configured such a field as "Private" on an authorless entity type and that the attacker can already view the entity. Fields on entities with authors and those using custom permissions are not affected. The vulnerability is fixed in version 1.6.0 of the module.