SA-CONTRIB-2026-288: Critical severity composer/drupal/field_permissions vulnerability
This module enables you to set field-level permissions to create, update or view individual fields. The module does not sufficiently verify administrative privileges when checking access to protected fields, potentially allowing users with a role named administrator to bypass field-level access restrictions and gain unauthorized view and edit access to protected fields. This vulnerability is mitigated by the fact that an attacker must have a role with the machine name administrator that is not flagged as the site's administrator role. Sites that use Drupal's default administrator role configuration are not affected.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/field_permissionsto a version that resolves this vulnerability.Fixed in 8.x-1.6
Event History
Frequently Asked Questions
Which sites are exposed?
A site is exposed only if it has a role with the machine name administrator that is not flagged as the site's administrator role. Sites using Drupal's default administrator role configuration are not affected.
What does an attacker need to exploit this issue?
The attacker must have a role named administrator whose machine name is administrator, but which is not configured as the site's administrator role. That role can then bypass field-level access restrictions for protected fields.
What access could be gained through the bypass?
Affected users may gain unauthorized ability to view and edit protected fields despite configured field-level permissions.