EUVD-2026-107846
GHSA-7r58-7q87-mv6m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged Drupal user
-
ExploitRequest access-controlled module endpoint directly
-
ExecutionMissing authorization check not enforced
-
ImpactLimited unauthorized action on table field data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an existing authenticated session on a Drupal site with the Ultimate Table Field module installed and running an affected version (0.0.0 up to 1.1.1, or 2.0.0 up to 2.0.1), per CVSS PR:L. There is no user-interaction requirement (UI:N) and the endpoint is network-reachable (AV:N) with low complexity (AC:L). The limiting factors that reduce real-world risk are the authentication requirement (a valid low-privilege account is needed), the integrity-only, low-magnitude impact (C:N/A:N, I:L, scope unchanged), and the requirement that the specific contributed module be installed rather than being a Drupal core flaw. |
| Impact | This is a moderate-severity, low-urgency issue and the signals are consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3) describes a network-reachable but authenticated (PR:L) flaw with no confidentiality or availability impact and only limited integrity impact - a low-privileged Drupal user bypassing a missing authorization check via forceful browsing. EPSS is very low (0.15%, 4th percentile) and the CVE is NOT on the CISA KEV list, so there is no evidence of active exploitation. No public exploit code is referenced; the only references are the Drupal vendor advisory (SA-contrib-2026-153) and the NVD/EUVD mirror. The vuln.today decision label is 'this_month', not 'act_now' or 'emergency', which aligns with the low EPSS and the capped integrity-only impact. Net: this is a genuine authorization-control weakness worth patching on a normal maintenance cycle, not a high-CVSS-but-illusory issue and not an emergency. One minor note: CWE-862 (Missing Authorization) and the 'forceful browsing' description most naturally suggest unauthorized read access, yet the vendor vector sets C:N and I:L - the exact nature of the limited integrity impact is not spelled out in the available sources; verify the affected resource with the vendor advisory. |
| Exploit ScenarioDerived | An attacker who already holds a low-privilege authenticated account on a Drupal site running Ultimate Table Field directly requests a module URL/endpoint that should be access-restricted, and the missing authorization check lets them reach it (forceful browsing). The CVSS low attack complexity and network vector mean the request is trivial to craft once authenticated, but the impact is limited (integrity-only, no confidentiality or availability loss). No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 22, 2026
A missing authorization check (CWE-862) in the Drupal contributed module Ultimate Table Field lets authenticated users bypass intended access control and reach functionality or data they should not be permitted to access, a pattern Drupal classifies as forceful browsing. Versions 0.0.0 through 1.1.1 and 2.0.0 through 2.0.1 are affected; exploitation requires a valid low-privilege session (CVSS PR:L) on a site with the module installed, with network reachability and low attack complexity but impact limited to low-magnitude integrity effects. No public exploit code and no confirmed active exploitation are indicated, EPSS is low at roughly 0.15% (4th percentile), and the vendor has released a fix.
RemediationAI
Patch status is vendor-released per the Drupal security advisory SA-CONTRIB-2026-153 (https://www.drupal.org/sa-contrib-2026-153); because the fix lands in the 1.x and 2.x branches, sites on the 1.x line should update past 1.1.1 and sites on the 2.x line should update past 2.0.1 to the fixed releases named in that advisory. The module's update path follows standard Drupal contributed-module practice: download the fixed release, run database updates if the advisory specifies any, and confirm the module version under Reports > Available updates. Where an immediate upgrade is not possible, the practical compensating control is to disable the Ultimate Table Field module (or remove the affected table fields from content types and views) until it can be updated, accepting the loss of that field functionality; restricting which roles receive permissions tied to the module's field widgets limits exposure to the low-privilege authenticated users required by the PR:L vector. Urgency is low: EPSS is roughly 0.15% (4th percentile), there is no KEV listing and no confirmed public exploit.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Ultimate Table Field is a contributed Drupal field module that provides table-structured field widgets and formatters, so it sits directly on the Field API layer that Drupal uses to attach structured data to entities. The flaw is CWE-862 (Missing Authorization), meaning a code path that should verify the acting user's permission - for example an entity field access check or a route/controller permission requirement - does not do so, leaving the intended capability reachable directly rather than through a properly gated UI, which is why it is characterized as forceful browsing. The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N indicates the attack is network-reachable at low complexity and needs only low privileges, with no user interaction, producing a low integrity-only impact inside the unchanged Drupal security scope - no confidentiality exposure or availability loss is assessed. The affected package range is captured by the CPE drupal:ultimate_table_field, and the issue is in the contributed module, not Drupal core, so only sites that installed and enabled this field module are exposed; the trigger mechanics beyond the missing authorization gate are not described in the available sources.
Know when Ultimate Table Field gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Forceful browsing over the web requires a logged-in low-privilege account (PR:L) with no interaction (UI:N); the advisory indicates limited integrity impact only (I:L, C:N/A:N), scope unchanged.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
2DescriptionCVE.org
Missing Authorization vulnerability in Drupal Ultimate Table Field allows Forceful Browsing. This issue affects Ultimate Table Field versions: from 0.0.0 to 1.1.1, from 2.0.0 to 2.0.1.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB