- Package
- drupal/field_permissions
- Fixed in
- 1.6.0
- Published
- Wed 28 Oct 2026, 17:41 LisbonUpdated Mon 2 Nov 2026, 07:25 Lisbon
In plain words
The Field Permissions module may let users view and edit protected fields without permission. This can happen when a user has a role with the machine name administrator that is not flagged as the site's administrator role. Sites using Drupal's default administrator role configuration are not affected.
Am I affected?
Check composer.lock for drupal/field_permissions and its installed version. The advisory lists 1.6.0 as fixed but gives no affected version range. Check whether any users have a role with the machine name administrator that is not flagged as the site's administrator role. Sites using Drupal's default administrator role configuration are not affected.
What to do
Check which version you have, then update to a fixed release for your branch (1.6.0):
composer show drupal/field_permissions | grep versions
composer update drupal/field_permissionsIf your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.
If you cannot update yet
Use Drupal's default administrator role configuration, which the advisory says is not affected.
The advisory's description
This module enables you to set field-level permissions to create, update or view individual fields.
The module does not sufficiently verify administrative privileges when checking access to protected fields, potentially allowing users with a role named administrator to bypass field-level access restrictions and gain unauthorized view and edit access to protected fields.
This vulnerability is mitigated by the fact that an attacker must have a role with the machine name administrator that is not flagged as the site's administrator role. Sites that use Drupal's default administrator role configuration are not affected.