CVE-2026-118583

Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0...

CVE-2026-118584

Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0...

CVE-2026-118583

The Field Permissions module for Drupal (versions 0.0.0 to 1.6.0 ) contains an Incorrect Authorization vulnerability (CWE-863) that allows for Forceful Browsing . The module fails to sufficiently verify administrative privileges when checking access to protected fields. This could allow users wit...

CVE-2026-118583 Field Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-288

Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0...

EUVD-2026-113686

Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0...

CVE-2026-118584

Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0...

CVE-2026-118584 Field Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-289

Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0...

CVE-2026-118584

The Field Permissions module for Drupal (versions 0.0.0 to 1.6.0) contains an Incorrect Authorization vulnerability. The module fails to sufficiently restrict access to fields configured with the Private setting on entity types that lack an author field (such as a user account or owner). This all...

EUVD-2026-113685

Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0...

CVE-2026-118583: Drupal Field Permissions: Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing

Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0...

CVE-2026-118584: Drupal Field Permissions: Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing

Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0...

DRUPAL-CONTRIB-2026-289

The Field Permissions module enables you to set field-level permissions for viewing and editing fields, including a "Private" setting. The module does not sufficiently restrict access to "Private" fields on entity types that have no field for an author user account or owner. As a result, a field...

DRUPAL-CONTRIB-2026-288

This module enables you to set field-level permissions to create, update or view individual fields. The module does not sufficiently verify administrative privileges when checking access to protected fields, potentially allowing users with a role named administrator to bypass field-level access...

Field Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-288

This module enables you to set field-level permissions to create, update or view individual fields. The module does not sufficiently verify administrative privileges when checking access to protected fields, potentially allowing users with a role named administrator to bypass field-level access...

Field Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-289

The Field Permissions module enables you to set field-level permissions for viewing and editing fields, including a "Private" setting. The module does not sufficiently restrict access to "Private" fields on entity types that have no field for an author user account or owner. As a result, a field...

PT-2026-130606

The Field Permissions module enables you to set field-level permissions for viewing and editing fields, including a "Private" setting. The module does not sufficiently restrict access to "Private" fields on entity types that have no field for an author user account or owner. As a result, a field...

CVE-2026-18115 In Concrete CMS 9.2.0 to 9.5.2, Missing Authorization in REST API Users update() and change_password Enables Account Takeover.

Concrete CMS 9.2.0 to 9.5.2 did not enforce per-field edituserproperties permissions on the REST API user write endpoints PUT /ccm/api/1.0/users/uID and POST /ccm/api/1.0/users/uID/changepassword. A user with an update-scoped OAuth token and permission to edit only one non-sensitive field could...

CVE-2026-66059

Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, a field-level permissions bypass exposes restricted DocType fields. This issue is fixed in versions 16.23.0 and 15.112.0...

CVE-2026-66059 Frappe: Field-level permission bypass via Document Follow

Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, a field-level permissions bypass exposes restricted DocType fields. This issue is fixed in versions 16.23.0 and 15.112.0...

CVE-2026-66059 Frappe: Field-level permission bypass via Document Follow

Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, a field-level permissions bypass exposes restricted DocType fields. This issue is fixed in versions 16.23.0 and 15.112.0...