Drupal Edit in-place field CVE-2026-18985

Exploitation requires a valid, authenticated Drupal user session with at least 'authenticated user' role permissions (CVSS PR:L confirms this). The Edit in-place field contrib module must be installed and enabled on the target Drupal site. No additional configuration or non-default setup is required beyond module presence. Exploitation is limited by the authentication barrier - anonymous visitors cannot exploit this flaw - and by the specific module being installed, which constrains exposure to Drupal sites that have deployed this particular contrib module.

The CVSS 8.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) signals high severity but requires authenticated access (PR:L), which meaningfully constrains the attacker pool to users with at least a basic Drupal account. EPSS at 0.13% (3rd percentile) indicates very low observed exploitation probability relative to other vulnerabilities - a significant divergence from the high CVSS score, suggesting this is more of an architectural authorization gap than an actively targeted attack surface. No CISA KEV listing and no POC availability reinforce that exploitation remains theoretical at this time. The combination of required authentication and low EPSS makes this a medium-urgency patch priority for most organizations, though sites with untrusted registered users or self-registration enabled should treat it as higher priority given the I:H integrity impact.

An attacker with a low-privilege Drupal account - such as a registered site member - crafts direct HTTP requests to field-edit endpoints for content they do not have editorial access to, bypassing the module's authorization check. By iterating over known node IDs and field names, the attacker can read sensitive field data or overwrite field values on content they should have no access to modify.