SA-CONTRIB-2026-289: Critical severity composer/drupal/field_permissions vulnerability
The Field Permissions module enables you to set field-level permissions for viewing and editing fields, including a "Private" setting. The module does not sufficiently restrict access to "Private" fields on entity types that have no field for an author (user account or owner). As a result, a field configured as "Private" on one of these entities can be viewed. Where the entity is editable, the entity can also be edited by anyone who can view it, including anonymous users. This vulnerability is mitigated by the fact that an administrator must have configured a field as "Private" on an entity type that has no author, and the attacker must already be able to view that entity. Fields set to "Private" on nodes, users, media, comments, and other entity types with an author are not affected. Fields using Custom permissions are not affected.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/field_permissionsto a version that resolves this vulnerability.Fixed in 8.x-1.6
Event History
Frequently Asked Questions
Which configurations are affected?
Only fields configured as "Private" on entity types that have no author field (user account or owner) are affected. Private fields on nodes, users, media, comments, and other entity types with an author are not affected, and fields using Custom permissions are not affected.
What access does an attacker need?
An attacker must already be able to view the affected entity. If that entity is editable, anyone who can view it, including anonymous users, can also edit it.
Are anonymous users at risk?
Anonymous users are affected only when they can view an editable entity with no author field that contains a field configured as Private. In that case, they can view the Private field and edit the entity.