EUVD-2026-114569

Improper Authorization vulnerability in Drupal Field Collection for Drupal 7 allows a user with the "edit field collections" permission to bypass access control on the parent host entity. The access check for field collection items fieldcollectionitemaccess granted edit and delete access to any...

CVE-2026-77152

An improper authorization vulnerability in Field Collection for Drupal 7 (versions 7.x-1.0 through 7.x-1.2) allows users to bypass access controls on host entities. The field_collection_item_access() function fails to verify if a user has permission to access the parent entity, granting edit and ...

CVE-2026-77152 Field Collection for Drupal 7 access bypass via missing parent entity access check

Improper Authorization vulnerability in Drupal Field Collection for Drupal 7 allows a user with the "edit field collections" permission to bypass access control on the parent host entity. The access check for field collection items fieldcollectionitemaccess granted edit and delete access to any...