EUVD-2026-114569
GHSA-f2vh-vxfq-92pj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with 'edit field collections' permission
-
ExploitRequest field collection item edit/delete endpoint
-
ExecutionBypass missing host-entity access check
-
ImpactModify or delete items on restricted parent entity
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization verification
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated Drupal 7 account holding the non-default 'edit field collections' permission on a site running the Field Collection module (versions 7.x-1.0 to 7.x-1.2), with field collection items attached to a host entity (e.g. a node) that the attacker lacks edit/update access to. Exploitation is limited by needing that specific permission to be granted and by the presence of host entities the attacker is otherwise restricted from editing; it does not work for anonymous or fully unprivileged users, and impact is confined to field collection items on entities the attacker cannot normally edit. |
| Impact | This is a medium-severity, authenticated authorization flaw (CWE-285), not a high-impact emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N, 5.3) shows network reach and low complexity but requires an existing low-privileged account holding the non-default 'edit field collections' permission (PR:L), and impact is limited to low confidentiality and low integrity with no availability effect and no scope change. The vuln.today decision label is 'this_month', consistent with a real-but-not-urgent issue. No EPSS score, no CISA KEV listing, and no proof-of-concept reference are present in the supplied data, so there is no signal of active or probable exploitation to elevate priority. In short, the raw CVSS and the decision framework agree this is a genuine access-control weakness worth patching on a normal cycle rather than a drop-everything priority; the main caveat is that EPSS data is entirely absent, so exploitation probability could not be weighed independently. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged account with the 'edit field collections' permission (for example a contributor role) targets field collection items attached to a node they are not allowed to edit. Because the access check granted edit/delete rights on the field collection permission alone without checking host-entity access, they submit the field collection item edit or delete request directly and modify or remove content on the restricted parent entity. No public exploit identified at time of analysis, and no user interaction beyond the attacker's own authenticated request is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 31, 2026
Improper authorization in the Drupal 7 Field Collection module (7.x-1.0 through 7.x-1.2) allows an authenticated user who holds the non-default 'edit field collections' permission to edit or delete field collection items attached to a host entity - such as a node - that the user is not permitted to edit. The field_collection_item_access() callback grants edit and delete rights on the strength of the collection permission alone, so the host entity's access restrictions are silently skipped, yielding limited confidentiality and integrity impact (CVSS 5.3, independently assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). No public exploit code and no CISA KEV listing appear in the provided intelligence, and the priority is rated this_month rather than an emergency.
RemediationAI
No exact fixed release version is stated in the provided data; the affected branch is 7.x-1.0 through 7.x-1.2 and the vendor notes the correction adds a check for access to the parent entity alongside the field collection permission, so track the HeroDevs entry (https://www.herodevs.com/vulnerability-directory/cve-2026-77152) and the D7ES advisory listing (https://d7es.tag1.com/security-advisories?field_project_target_id=96) for the build that carries the corrected field_collection_item_access() and deploy it as the complete fix. Until that build is applied, the highest-value control is permission hygiene: audit which roles hold the non-default 'edit field collections' permission and strip it from any role that does not also have edit/update access to every host entity type carrying field collection items - the trade-off is that those editors lose the ability to edit field collection fields through the host entity form and must be handled by an administrator instead. Where field collections are attached to sensitive node types (private, unpublished or per-user content), consider temporarily removing the permission entirely if only administrators need to edit collections, accepting the same loss of delegated editing as the cost. Restricting the module's field-editing form paths at the web server or reversing the permission grant for untrusted roles reduces exposure but does not fix the underlying callback and leaves any role that regains the permission exploitable.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Field Collection is a Drupal 7 module that models each field collection as its own entity (field_collection_item) attached to a host entity through a field_collection field. Drupal 7 routes entity operations through access callbacks, and this module implements field_collection_item_access($op, $item, $account, $entity), which is consulted for view, edit and delete operations on the item. The defect is a missing authorization check on the parent resource (CWE-285, Improper Authorization): for edit and delete operations the callback returns access based only on whether the account carries the 'edit field collections' permission, and never calls entity_access() against the host entity to confirm the account may update it. This is effectively a confused-deputy pattern in which a legitimate module-level permission is treated as authority over any host object the item hangs off. The CPE cpe:2.3:a:drupal:field_collection_for_drupal_7:*:*:*:*:*:*:*:* is a wildcard, so the version range in the vendor description (7.x-1.0 up to and including 7.x-1.2) is the authoritative affected set. The trigger is a user submitting an edit or delete operation against a field collection item whose host entity they cannot otherwise edit; the underlying request path is not further described in the available sources. The vendor states the remediation requires verifying access to the parent entity in addition to the field collection permission.
Know when Field Collection For Drupal 7 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
An authenticated user with a specific permission (PR:L) edits/deletes restricted items over the network with low complexity; limited data exposure and modification (C:L/I:L), no availability impact, scope unchanged within the application.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
DescriptionCVE.org
Improper Authorization vulnerability in Drupal Field Collection for Drupal 7 allows a user with the "edit field collections" permission to bypass access control on the parent (host) entity.
The access check for field collection items (field_collection_item_access()) granted edit and delete access to any user holding the "edit field collections" permission without verifying the user's access to the host entity. As a result, a user with "edit field collections" but without edit/update access to the host entity (for example a node they cannot edit) could edit or delete field collection items attached to that entity, bypassing the intended entity/node access restrictions. The fix requires access to the parent entity in addition to the field collection permission.
This issue affects Field Collection for Drupal 7: version 7.x-1.0 up to and including 7.x-1.2.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB