DRUPAL-CONTRIB-2026-288

This module enables you to set field-level permissions to create, update or view individual fields.

The module does not sufficiently verify administrative privileges when checking access to protected fields, potentially allowing users with a role named administrator to bypass field-level access restrictions and gain unauthorized view and edit access to protected fields.

This vulnerability is mitigated by the fact that an attacker must have a role with the machine name administrator that is not flagged as the site's administrator role. Sites that use Drupal's default administrator role configuration are not affected.