SA-CONTRIB-2026-093: Critical severity drupal/edit_in_place_field vulnerability
Published Aug 5, 2026
·Updated
This module provides formatters to allow in-place editing in a View or other display (full content, teaser...). The module doesn't sufficiently check access when editing entities. A malicious user could craft requests to allow them to modify any field on any entity. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "edit in place field editing permission".
Credit
Drew Webber (mcdruid)(the Drupal Security Team)
Affected Software
1 affected componentFixes available
drupal/edit_in_place_field<2.1.1
2.1.1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/edit_in_place_fieldto a version that resolves this vulnerability.Fixed in 2.1.1 - Compensating control
Ensure only users with the permission "edit in place field editing permission" can perform in-place editing, since exploitation requires an attacker role with that permission.
Event History
Aug 5, 2026
Advisory Published
via Drupal·12:00 AM
Data Sourced
via Drupal·12:00 AM
DescriptionSeverityAffected Software