Improper Authorization in Drupal 7 Field Collection by Drupal

CVE-2026-77152

What is CVE-2026-77152?

An improper authorization vulnerability in the Field Collection module for Drupal 7 enables users with the 'edit field collections' permission to circumvent access controls on the parent entity. This weakness allows unauthorized users to edit or delete field collection items attached to a host entity without possessing the required permissions for that entity, leading to potential data manipulation. To rectify this issue, it is necessary to enforce access checks not only on the field collections but also on the associated parent entities.

References