{"id":"CVE-2026-81269","aliases":["DRUPAL-CONTRIB-2026-108","EUVD-2026-70003","GHSA-rq35-w8f7-p43g"],"status":"published","title":"Data field - Moderately critical - Information disclosure - SA-CONTRIB-2026-108","description":"Missing Authorization vulnerability in Drupal Data field allows Forceful Browsing. This issue affects Data field versions: from 0.0.0 to 2.0.13.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00325,"percentile":0.25863,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-862"],"published":"2026-08-26T17:37:11Z","modified":"2026-10-28T02:31:14Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/datafield","fixed_in":["2.0.13"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/datafield","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.13"}]}]}],"products":[{"vendor":"data_field_project","product":"data_field"},{"vendor":"drupal","product":"data field"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2026-108","tags":["Vendor Advisory","web"]},{"url":"https://www.drupal.org/sa-contrib-2026-111","tags":["Not Applicable","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81269","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-rq35-w8f7-p43g"},{"url":"https://git.drupalcode.org/project/datafield","tags":["web"]},{"url":"https://www.drupal.org/project/datafield","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81269.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-81269","title":"Data field - Moderately critical - Information disclosure - SA-CONTRIB-2026-108","description":"Missing Authorization vulnerability in Drupal Data field allows Forceful Browsing. This issue affects Data field versions: from 0.0.0 to 2.0.13.","status":"published","published":"2026-09-02T12:32:02.396Z","modified":"2026-09-02T19:01:56.277Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T13:36:18.075535Z"}],"euvd":[{"id":"EUVD-2026-70003","description":"Missing Authorization vulnerability in Drupal Data field allows Forceful Browsing. This issue affects Data field versions: from 0.0.0 to 2.0.13.","status":"published","published":"2026-09-02T12:32:02Z","modified":"2026-09-02T19:01:56Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T18:01:14.689075Z"}],"ghsa":[{"id":"GHSA-rq35-w8f7-p43g","title":"Missing Authorization vulnerability in Drupal Data field allows Forceful Browsing. This issue...","description":"Missing Authorization vulnerability in Drupal Data field allows Forceful Browsing. This issue affects Data field versions: from 0.0.0 to 2.0.13.","status":"published","published":"2026-09-02T15:34:48Z","modified":"2026-09-02T21:33:10Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:11:18.49317Z"}],"nvd":[{"id":"CVE-2026-81269","description":"Missing Authorization vulnerability in Drupal Data field allows Forceful Browsing. This issue affects Data field versions: from 0.0.0 to 2.0.13.","status":"published","published":"2026-09-02T13:18:12.917Z","modified":"2026-09-09T18:37:12.863Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:12:43.399612Z"}],"osv":[{"id":"CVE-2026-81269","title":"Data field - Moderately critical - Information disclosure - SA-CONTRIB-2026-108","description":"Missing Authorization vulnerability in Drupal Data field allows Forceful Browsing. This issue affects Data field versions: from 0.0.0 to 2.0.13.","status":"published","published":"2026-09-02T12:32:02.396Z","modified":"2026-10-28T02:31:14.859312901Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:45:18.131258Z"},{"id":"DRUPAL-CONTRIB-2026-108","description":"This module enables you to store structured data in configurable fields and expose Data Field values through JSON endpoints.\n\nThe module doesn't sufficiently check access when returning Data Field values through its JSON endpoint. This may allow anonymous users to access field values belonging to entities they cannot otherwise view, including unpublished content.","status":"published","published":"2026-08-26T17:37:11Z","modified":"2026-09-02T19:55:29.393088595Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}