Field Collection For Drupal 7
Monthly
Improper authorization in the Drupal 7 Field Collection module (7.x-1.0 through 7.x-1.2) allows an authenticated user who holds the non-default 'edit field collections' permission to edit or delete field collection items attached to a host entity - such as a node - that the user is not permitted to edit. The field_collection_item_access() callback grants edit and delete rights on the strength of the collection permission alone, so the host entity's access restrictions are silently skipped, yielding limited confidentiality and integrity impact (CVSS 5.3, independently assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). No public exploit code and no CISA KEV listing appear in the provided intelligence, and the priority is rated this_month rather than an emergency.
Improper authorization in the Drupal 7 Field Collection module (7.x-1.0 through 7.x-1.2) allows an authenticated user who holds the non-default 'edit field collections' permission to edit or delete field collection items attached to a host entity - such as a node - that the user is not permitted to edit. The field_collection_item_access() callback grants edit and delete rights on the strength of the collection permission alone, so the host entity's access restrictions are silently skipped, yielding limited confidentiality and integrity impact (CVSS 5.3, independently assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). No public exploit code and no CISA KEV listing appear in the provided intelligence, and the priority is rated this_month rather than an emergency.