CVE-2026-77152

Overview

Drupal is an open-source content management system known for its flexibility, robust features, and strong community support. Organizations of all sizes use it to build and manage dynamic websites and web applications.

Field Collection provides a field-collection field that can contain any number of attached fields. Each field collection is represented internally as an entity embedded in a host entity, so collection items can also be viewed and edited separately.

The Field Collection module for Drupal 7 fails to check access to the parent (host) entity when authorizing edits to field collection items, so any user with the "edit field collections" permission can edit or delete field collection items attached to entities they are not permitted to modify. This access bypass lets a low-privileged authenticated user alter content on nodes or other host entities that node/entity access controls should have protected.

Broken Access Control occurs when an application fails to properly enforce restrictions on what authenticated users are allowed to do, enabling attackers to access unauthorized functionality, data, or resources. It often stems from inadequate validation of user permissions, allowing someone to bypass intended security boundaries and perform actions beyond their assigned role.

Details

Module Info

• Product: Drupal 7
• Affected packages: Field Collection
• Affected versions: 7.1.0
• Repository: https://git.drupalcode.org/project/field_collection
• Published packages: https://www.drupal.org/project/field_collection
• Package manager: composer
• Fixed in: Field Collection NES 7.1.3

Vulnerability Info

This medium-severity vulnerability is found in versions of the Drupal Field Collection module for Drupal 7 sites, version 7.1.0.

Prior to the fix, field_collection_item_access() in field_collection.module authorized edit and delete operations on a field collection item by checking only user_access('edit field collections'), never consulting the access controls of the host entity that owns the item. Because a field collection item is not an independently-permissioned entity but a child of a host entity (e.g., a node), this allowed any authenticated user holding that single permission to reach the item's /field-collection/{field}/{item_id}/edit and /delete menu callbacks and mutate content on host entities they had no update access to, bypassing node/entity access entirely. A secondary weakness meant that when the host entity could not be loaded, the check defaulted to granting access rather than denying it.

Addressing the Issue

Users of this module should apply one of the following mitigations:

• If the risk is unacceptable, disable the Field Collection module until the fix can be deployed.
• Restrict the "edit field collections" permission to highly trusted users only—ideally only roles that already have edit access to the host content.
• Audit field collection content on existing nodes and other host entities for unexpected edits or deletions, and restore any content altered by users who lack access to the parent entity.
• Sign up for post-EOL security support—HeroDevs customers get immediate access to a patched version of this module.

Credits

Ra Mänd (ram4nd)