CVE-2026-18985 - Edit in-place field - Moderately critical - Access bypass

Back Back to CVE browser

HIGH

Edit in-place field - Moderately critical - Access bypass - SA-CONTRIB-2026-093

Published Aug 25, 2026

8.1

HIGH

CVSS 3.1

EPSS 0.20%

Description

Incorrect Authorization vulnerability in Drupal Edit in-place field allows Forceful Browsing. This issue affects Edit in-place field versions: from 0.0.0 to 2.1.1.

Affected products

Vendor Drupal Product Edit in-place field Default
unknown
Affected
- ≥ 0.0.0, < 2.1.1

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Drupal	Edit in-place field	unknown	Affected ≥ 0.0.0, < 2.1.1

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-285

CWE-863

Incorrect Authorization

References (2)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-66197		Advisory
https://www.drupal.org/sa-contrib-2026-093

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner drupal

Published Aug 25, 2026

Updated Aug 26, 2026

Reserved Aug 5, 2026

Link CVE-2026-18985

CISA Vulnrichment

Updated Aug 26, 2026

NVD

Status Awaiting Analysis

Modified Aug 28, 2026

Link CVE-2026-18985

Red Hat

No data

ENISA EUVD

Assigner drupal

Published Aug 25, 2026

Updated Aug 26, 2026

Link EUVD-2026-66197

GitHub

No data