An improper authorization vulnerability in the Drupal Field Collection module for Drupal 7 allows users with the "edit field collections" permission to bypass access controls on the parent entity. This flaw permits such users to edit or delete field collection items attached to entities they normally cannot edit. The issue affects versions 7.x-1.0 through 7.x-1.2 of the module.