Executive brief
The Edit in-place field module for Drupal allows website administrators to let authorized users edit content directly on pages without navigating to an editing interface. A flaw in the module's permission checking allows any user with basic in-place editing privileges to modify any field on any entity across the site, bypassing the normal access controls that restrict who can edit specific content. This could allow unauthorized modification of published articles, user profiles, or other sensitive data.
Technical details
The vulnerability is an access control bypass in the Edit in-place field module where insufficient authorization checks are performed before allowing entity field modifications. An attacker who possesses the "edit in place field editing permission" role can craft direct requests to modify fields on any entity, circumventing the standard Drupal permission system. The vulnerability affects versions before 2.1.1 and requires the attacker to already hold the specified permission—a mitigation that limits but does not prevent exploitation in environments where multiple user roles have this permission. The fix is available in version 2.1.1 and later.
Affected products
- Drupal Edit in-place field 0.0.0 to 2.1.0
Timeline
- 2026-08-05: disclosed
- 2026-08-05: patched: Version 2.1.1 released