CVE-2026-118584

Low risk· EPSS 3%

Published: 30/10/2026(UTC)Updated: 30/10/2026(UTC)Translated: 30/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.13%

3th percentile - higher than 3% of all known CVEs

Summary

The Field Permissions module for Drupal contains an incorrect authorization vulnerability that allows forceful browsing. This issue affects versions from 0.0.0 to 1.6.0.

Risk Assessment

An attacker could bypass field access control mechanisms and reach content or functions that should be restricted.

Recommendation

Update the Field Permissions module to a version newer than 1.6.0 and review the field permission configuration.

Other vulnerabilities in Drupal Field Permissions

CVE-2026-118583Low risk· EPSS 3%
The Field Permissions module for Drupal contains an incorrect authorization vulnerability that allows forceful browsing. This issue affects versions from 0.0.0 to 1.6.0.

Original NVD description (English source)

Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS