SB2026103027 - Multiple vulnerabilities in Field Permissions module for Drupal

Description

This security bulletin contains information about 2 vulnerabilities.

1) Incorrect authorization (CVE-ID: CVE-2026-118583)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to bypass authorization checks.

The vulnerability exists due to the affected module does not sufficiently verify administrative privileges when checking access to protected fields. A remote administrator can gain unauthorized view and edit access to protected fields.

2) Incorrect authorization (CVE-ID: CVE-2026-118584)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass authorization checks.

The vulnerability exists due to the affected module does not sufficiently restrict access to "Private" fields on entity types that have no field for an author. A remote attacker can gain access to sensitive information on the system.

Remediation

Install update from vendor's website.

References

• https://www.drupal.org/sa-contrib-2026-288
• https://www.drupal.org/sa-contrib-2026-289