DRUPAL-CONTRIB-2026-093unknown
DRUPAL-CONTRIB-2026-093
The advisory, in context
This module provides formatters to allow in-place editing in a View or other display (full content, teaser...).
The module doesn't sufficiently check access when editing entities. A malicious user could craft requests to allow them to modify any field on any entity.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "edit in place field editing permission".
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
drupal/edit_in_place_field Packagist:https://packages.drupal.org/8
Ecosystem versions
Earlier releases before 2.1.1
Fixed in 2.1.1
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.1.1"
}
],
"type": "ECOSYSTEM",
"database_specific": {
"constraint": "<2.1.1"
}
}
],
"versions": []
}