EUVD-2026-66197
GHSA-xgjg-vwwh-m3x2
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network-accessible web module; low-privilege auth required (PR:L); no scope change; high C and I from unrestricted field read/write; no availability impact.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
4DescriptionCVE.org
Incorrect Authorization vulnerability in Drupal Edit in-place field allows Forceful Browsing. This issue affects Edit in-place field versions: from 0.0.0 to 2.1.1.
AnalysisAI
Incorrect authorization in the Drupal Edit in-place field contrib module (versions 0.0.0 through pre-2.1.1) enables authenticated users to perform forceful browsing against field-edit endpoints they lack permission to access, resulting in unauthorized read and write access to protected Drupal field data. The CVSS base score of 8.1 reflects high confidentiality and integrity impact, though real-world risk is tempered by the authentication prerequisite (PR:L) and an extremely low EPSS score of 0.13% (3rd percentile). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid, authenticated Drupal user session with at least 'authenticated user' role permissions (CVSS PR:L confirms this). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) signals high severity but requires authenticated access (PR:L), which meaningfully constrains the attacker pool to users with at least a basic Drupal account. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the Edit in-place field Drupal module to version 2.1.1 or later, as confirmed available per the Drupal security advisory at https://www.drupal.org/sa-contrib-2026-093. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory Drupal installations to identify those running the Edit in-place field module and document current versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today