PT-2026-134253
CVE-2026-77152
·
Published
2026-10-30
·
Updated
2026-11-03
Description by
CVSS 4.0
5.3
MediumMetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
Drupal Field Collection for Drupal 7 versions 7.x-1.0 through 7.x-1.2
Description
An improper authorization issue exists where users with the "edit field collections" permission can bypass access controls on the parent host entity. The
field collection item access() function grants edit and delete access to any user with this permission without verifying if the user has the necessary access to the host entity, such as a node. This allows a user to modify or remove field collection items attached to an entity they are not authorized to edit.Recommendations
Update Drupal Field Collection for Drupal 7 versions 7.x-1.0 through 7.x-1.2 to a version where the
field collection item access() function requires access to the parent entity in addition to the field collection permission.Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾