Investigate in your agent.

Turn this advisory into a focused investigation. Ask your agent to check your project’s versions, explain the evidence, and suggest a compatible fix.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

Skip to content
cve.new Create a CVE report
Check your stack
CVE-2026-77152medium5.3

Field Collection for Drupal 7 access bypass via missing parent entity access check

Impact

Improper Authorization vulnerability in Drupal Field Collection for Drupal 7 allows a user with the "edit field collections" permission to bypass access control on the parent (host) entity.

Source excerpt · drupal
Applies when

The fix requires access to the parent entity in addition to the field collection permission.

Affected packages

This source has no supported package-version data for matching. You can read the advisory here, but this record alone cannot power a dependency check.

Affected products

Vendor version evidence. Product records are separate from automatic dependency matching.

Drupal · drupal

Field Collection for Drupal 7

1 range
drupal version evidence

Compare with this publisher’s ranges. This does not inspect your installation.

affected

7.x-1.0 → through 7.x-1.2

custom versions

unaffected

unknown

Other versions: unaffected

Original source description

Improper Authorization vulnerability in Drupal Field Collection for Drupal 7 allows a user with the "edit field collections" permission to bypass access control on the parent (host) entity.

The access check for field collection items (field_collection_item_access()) granted edit and delete access to any user holding the "edit field collections" permission without verifying the user's access to the host entity. As a result, a user with "edit field collections" but without edit/update access to the host entity (for example a node they cannot edit) could edit or delete field collection items attached to that entity, bypassing the intended entity/node access restrictions. The fix requires access to the parent entity in addition to the field collection permission.

This issue affects Field Collection for Drupal 7: version 7.x-1.0 up to and including 7.x-1.2.

Inside the record

Evidence available

Package identity · not supplied
Version evidence
Remediation guidance · not supplied
Weakness classification
Additional publishers · not supplied

Describes the evidence in this view, not whether the product is safe.

Original records

CVE-2026-77152

View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.

cve.new JSON →

Underlying weaknesses

The source’s classification of what caused the vulnerability.

CWE-285 ↗

CWE-285 Improper Authorization

drupal

Related →
Contributing organizations · 1
drupal

Assigning organization

2026-10-30

What changed

Follow changes
No substantive changes have been recorded here yet. History starts when cve.new observes a change after tracking is enabled; earlier edits are not reconstructed.

Large field values are marked as truncated previews. Original source snapshots remain retained.

References

2 sources
www.herodevs.com/vulnerability-directory/cve-2026-77152
third-party-advisorydrupal
d7es.tag1.com/security-advisories
third-party-advisorydrupal