- Package
- drupal/field_permissions
- Fixed in
- 1.6.0
- Published
- Wed 28 Oct 2026, 17:41 Lisbon
In plain words
The Drupal Field Permissions module can let someone view a field marked "Private" on an entity type that has no author or owner field. If the entity is editable, anyone who can view it can also edit it, including anonymous users. This requires an administrator to have configured such a private field and the attacker to already be able to view the entity.
Am I affected?
Find drupal/field_permissions and its version in composer.lock. The advisory lists 1.6.0 as fixed but gives no affected version range. Check whether any field is set to Private on an entity type with no author or owner field, and who can view those entities. Private fields on nodes, users, media, comments and other entity types with an author are not affected; fields using Custom permissions are also not affected.
What to do
Check which version you have, then update to a fixed release for your branch (1.6.0):
composer show drupal/field_permissions | grep versions
composer update drupal/field_permissionsIf your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.
If you cannot update yet
The advisory identifies fields using Custom permissions as unaffected, as well as private fields on entity types with an author.
The advisory's description
The Field Permissions module enables you to set field-level permissions for viewing and editing fields, including a "Private" setting.
The module does not sufficiently restrict access to "Private" fields on entity types that have no field for an author (user account or owner). As a result, a field configured as "Private" on one of these entities can be viewed. Where the entity is editable, the entity can also be edited by anyone who can view it, including anonymous users.
This vulnerability is mitigated by the fact that an administrator must have configured a field as "Private" on an entity type that has no author, and the attacker must already be able to view that entity. Fields set to "Private" on nodes, users, media, comments, and other entity types with an author are not affected. Fields using Custom permissions are not affected.