DRUPAL-CONTRIB-2026-108

Import Source

https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/datafield/DRUPAL-CONTRIB-2026-108.json

JSON Data

https://api.osv.dev/v1/vulns/DRUPAL-CONTRIB-2026-108

Aliases

CVE-2026-81269

Published

2026-08-26T17:37:11Z

Modified

2026-09-02T19:55:29Z

Summary

[none]

Details

This module enables you to store structured data in configurable fields and expose Data Field values through JSON endpoints.

The module doesn't sufficiently check access when returning Data Field values through its JSON endpoint. This may allow anonymous users to access field values belonging to entities they cannot otherwise view, including unpublished content.

References

https://www.drupal.org/sa-contrib-2026-108

Credits

- Drew Webber (mcdruid)
- - https://www.drupal.org/u/mcdruid
- Marcus Johansson (marcus_johansson)
- - https://www.drupal.org/u/marcus_johansson
- Steven Jones (steven jones)
- - https://www.drupal.org/u/steven-jones

Affected packages

Packagist:https://packages.drupal.org/8 / drupal/datafield

Package

Name: drupal/datafield
Purl: pkg:composer/drupal/datafield?repository_url=https:%2F%2Fpackages.drupal.org%2F8

Affected ranges

Type

ECOSYSTEM

Events

Introduced

Fixed

2.0.13

Database specific

Show details

{
    "constraint": "<2.0.13"
}

Database specific

affected_versions

"<2.0.13"

source

"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/datafield/DRUPAL-CONTRIB-2026-108.json"