DRUPAL-CONTRIB-2026-288: Composer/drupal/field_permissions vulnerability

Q: Which sites are exposed to this issue?

A site is exposed only if it has a role whose machine name is `administrator` and that role is not flagged as the site's administrator role. Sites using Drupal's default administrator role configuration are not affected.

Q: What access must an attacker already have to exploit this?

The attacker must have the role with the machine name `administrator` that is not designated as the site's administrator role. Under that condition, they may bypass field-level restrictions to view and edit protected fields.

Q: What can be done if an update cannot be applied immediately?

Review role configuration and ensure that no non-administrator role uses the machine name `administrator`. Using Drupal's default administrator role configuration mitigates the issue.

Q: How can administrators determine whether their site is affected?

Inspect the site's roles to determine whether a role named `administrator` exists and whether it is flagged as the site's administrator role. The issue applies when that machine-named role exists but is not the designated administrator role.

Published Oct 28, 2026

Updated

This module enables you to set field-level permissions to create, update or view individual fields.

The module does not sufficiently verify administrative privileges when checking access to protected fields, potentially allowing users with a role named administrator to bypass field-level access restrictions and gain unauthorized view and edit access to protected fields.

This vulnerability is mitigated by the fact that an attacker must have a role with the machine name administrator that is not flagged as the site's administrator role. Sites that use Drupal's default administrator role configuration are not affected.

Affected Software

1 affected componentFixes available

composer/drupal/field_permissions<1.6.0

1.6.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/field_permissions to a version that resolves this vulnerability.
Fixed in 1.6.0

Event History

Oct 28, 2026

Advisory Published

via OSV·05:41 PM

Data Sourced

via OSV·05:41 PM

DescriptionAffected Software

Frequently Asked Questions

Which sites are exposed to this issue?

A site is exposed only if it has a role whose machine name is `administrator` and that role is not flagged as the site's administrator role. Sites using Drupal's default administrator role configuration are not affected.

What access must an attacker already have to exploit this?

The attacker must have the role with the machine name `administrator` that is not designated as the site's administrator role. Under that condition, they may bypass field-level restrictions to view and edit protected fields.

What can be done if an update cannot be applied immediately?

Review role configuration and ensure that no non-administrator role uses the machine name `administrator`. Using Drupal's default administrator role configuration mitigates the issue.

How can administrators determine whether their site is affected?

Inspect the site's roles to determine whether a role named `administrator` exists and whether it is flagged as the site's administrator role. The issue applies when that machine-named role exists but is not the designated administrator role.

DRUPAL-CONTRIB-2026-288: Composer/drupal/field_permissions vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which sites are exposed to this issue?

What access must an attacker already have to exploit this?

What can be done if an update cannot be applied immediately?

How can administrators determine whether their site is affected?

Company

Resources

Contact

Frequently Asked Questions

Which sites are exposed to this issue?

What access must an attacker already have to exploit this?

What can be done if an update cannot be applied immediately?

How can administrators determine whether their site is affected?