CVE-2026-81269: Data Field Module for Drupal Allows Unauthorized Access to Sensitive Data
Summary
CVE-2026-81269: This module enables you to store structured data in configurable fields and expose Data Field values through JSON endpoints. Affects drupal/datafield versions < 2.0.13. Fixed in 2.0.13. How to fix ↓
Also tracked for
- drupal/disable_login · Packagist:https://packages.drupal.org/8
The same CVE-2026-81269 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Data Field module for Drupal is designed to enable users to store structured data in configurable fields and expose these values through JSON endpoints. This functionality is crucial for developers who need to manage and present data dynamically on their websites. However, the module has a significant security flaw that can lead to unauthorized access to sensitive information.
Vulnerability Detail
The vulnerability arises from insufficient access checks when the Data Field module returns values through its JSON endpoint. This oversight allows anonymous users to access field values belonging to entities they should not be able to view, including unpublished content. The potential ramifications include exposure of sensitive data, which could lead to privacy violations and unauthorized data manipulation.
How To Fix
Minimum fixed version
2.0.13
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the JSON endpoint by implementing custom access control logic in your application. This can be done by modifying the module's permissions or using hooks to enforce stricter access checks.
Conclusion
The Data Field module for Drupal has a critical vulnerability (CVE-2026-81269) that allows unauthorized access to sensitive data through its JSON endpoints. It is crucial to update to version 2.0.13 or later to protect your application from potential data exposure. Implementing workarounds can provide temporary relief until the update is applied.
See every vulnerability recorded for drupal/datafield →
FAQ
The Data Field module allows users to store structured data in configurable fields and expose these values through JSON endpoints, facilitating dynamic data management on Drupal sites.
The vulnerability allows unauthorized access to sensitive field values through JSON endpoints due to insufficient access checks, potentially exposing unpublished content.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, implement custom access control logic as a temporary workaround to restrict access to the JSON endpoint.
For more information, you can reach out to the Drupal community or the contributors of the Data Field module, including Drew Webber, Marcus Johansson, and Steven Jones.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/datafield.
