View online: https://www.drupal.org/sa-contrib-2026-288 Project: Field Permissions [1] Project machine name: field_permissions Date: 2026-October-28 Security risk: *Moderately critical* 11 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <1.6.0 CVE IDs: CVE-2026-118583 Description:  This module enables you to set field-level permissions to create, update or view individual fields. The module does not sufficiently verify administrative privileges when checking access to protected fields, potentially allowing users with a role named administrator to bypass field-level access restrictions and gain unauthorized view and edit access to protected fields. This vulnerability is mitigated by the fact that an attacker must have a role with the machine name administrator that is not flagged as the site's administrator role. Sites that use Drupal's default administrator role configuration are not affected. Solution:  Install the latest version: * If you use the Field Permissions module, upgrade to Field Permissions 8.x-1.6 [3]. Reported By:  * narbehm [4] Fixed By:  * Jakob P (japerry) [5] * Mohit Aghera (mohit_aghera) [6] provisional member of the Drupal Security Team * narbehm [7] * Rob Loach (robloach) [8] Coordinated By:  * Swan Kalata (akalata) [9] of the Drupal Security Team * Bram Driesen (bramdriesen) [10] of the Drupal Security Team * Greg Knaddison (greggles) [11] of the Drupal Security Team * Lee Rowlands (larowlan) [12] of the Drupal Security Team * Mohit Aghera (mohit_aghera) [13], provisional member of the Drupal Security Team * Juraj Nemec (poker10) [14] of the Drupal Security Team * Jess (xjm) [15] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [16] [1] https://www.drupal.org/project/field_permissions [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/field_permissions/releases/8.x-1.6 [4] https://www.drupal.org/u/narbehm [5] https://www.drupal.org/u/japerry [6] https://www.drupal.org/u/mohit_aghera [7] https://www.drupal.org/u/narbehm [8] https://www.drupal.org/u/robloach [9] https://www.drupal.org/u/akalata [10] https://www.drupal.org/u/bramdriesen [11] https://www.drupal.org/u/greggles [12] https://www.drupal.org/u/larowlan [13] https://www.drupal.org/u/mohit_aghera [14] https://www.drupal.org/u/poker10 [15] https://www.drupal.org/u/xjm [16] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....