Ultimate Table Field
Monthly
A missing authorization check (CWE-862) in the Drupal contributed module Ultimate Table Field lets authenticated users bypass intended access control and reach functionality or data they should not be permitted to access, a pattern Drupal classifies as forceful browsing. Versions 0.0.0 through 1.1.1 and 2.0.0 through 2.0.1 are affected; exploitation requires a valid low-privilege session (CVSS PR:L) on a site with the module installed, with network reachability and low attack complexity but impact limited to low-magnitude integrity effects. No public exploit code and no confirmed active exploitation are indicated, EPSS is low at roughly 0.15% (4th percentile), and the vendor has released a fix.
A missing authorization check (CWE-862) in the Drupal contributed module Ultimate Table Field lets authenticated users bypass intended access control and reach functionality or data they should not be permitted to access, a pattern Drupal classifies as forceful browsing. Versions 0.0.0 through 1.1.1 and 2.0.0 through 2.0.1 are affected; exploitation requires a valid low-privilege session (CVSS PR:L) on a site with the module installed, with network reachability and low attack complexity but impact limited to low-magnitude integrity effects. No public exploit code and no confirmed active exploitation are indicated, EPSS is low at roughly 0.15% (4th percentile), and the vendor has released a fix.