Incorrect authorization in Field Permissions - CVE-2026-118584
Published: October 30, 2026
Vulnerability identifier: #VU158516
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-118584
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass authorization checks.
The vulnerability exists due to the affected module does not sufficiently restrict access to "Private" fields on entity types that have no field for an author. A remote attacker can gain access to sensitive information on the system.
Affected software
Field Permissions
How to mitigate CVE-2026-118584
Install updates from vendor's website.
Field Permissions - update to 1.6.0