SA-CONTRIB-2026-108: Critical severity drupal/datafield vulnerability
This module enables you to store structured data in configurable fields and expose Data Field values through JSON endpoints. The module doesn't sufficiently check access when returning Data Field values through its JSON endpoint. This may allow anonymous users to access field values belonging to entities they cannot otherwise view, including unpublished content.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/datafieldto a version that resolves this vulnerability.Fixed in 2.0.13
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using the Drupal Data Field module and exposing Data Field values through its JSON endpoint are affected. Anonymous users may be able to access values from entities they are not otherwise permitted to view, including unpublished content.
What access does an attacker need?
The issue may be exploitable by anonymous users. The described weakness is insufficient access checking when the JSON endpoint returns Data Field values.