Is CVE-2026-18985 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-18985 being exploited in the wild.

How severe is CVE-2026-18985?

High severity, with a CVSS score of 8.1, published 25 August 2026.

Which products and versions are affected?

Drupal Edit in-place field 0.0.0 to 2.1.0; Packagist:Https://Packages.Drupal.Org/8 Drupal/Edit In Place Field ECOSYSTEM:introduced=0,fixed=2.1.1.

Is there a fix for CVE-2026-18985?

Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Edit In Place Field: upgrade to 2.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-18985 attacked?

It is attacked over the network.

Am I affected by CVE-2026-18985?

Check whether you run Drupal Edit in-place field or Packagist:Https://Packages.Drupal.Org/8 Drupal/Edit In Place Field at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-18985: Drupal Edit in-place field authorization bypass

CVE-2026-18985 · Severity: high · CVSS 8.1 · Published 2026-08-25

The Edit in-place field module for Drupal allows website administrators to let authorized users edit content directly on pages without navigating to an editing interface. A flaw in the module's permission checking allows any user with basic in-place editing privileges to modify any field on any entity across the site, bypassing the normal access controls that restrict who can edit specific content. This could allow unauthorized modification of published articles, user profiles, or other sensitive data.

Vendors: Drupal, Packagist:Https://Packages.Drupal.Org/8.

Quick answers

Is CVE-2026-18985 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-18985 being exploited in the wild.
How severe is CVE-2026-18985?: High severity, with a CVSS score of 8.1, published 25 August 2026.
Which products and versions are affected?: Drupal Edit in-place field 0.0.0 to 2.1.0; Packagist:Https://Packages.Drupal.Org/8 Drupal/Edit In Place Field ECOSYSTEM:introduced=0,fixed=2.1.1.
Is there a fix for CVE-2026-18985?: Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Edit In Place Field: upgrade to 2.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-18985 attacked?: It is attacked over the network.
Am I affected by CVE-2026-18985?: Check whether you run Drupal Edit in-place field or Packagist:Https://Packages.Drupal.Org/8 Drupal/Edit In Place Field at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Packagist:Https://Packages.Drupal.Org/8 Drupal/Edit In Place Field: upgrade to 2.1.1 or later

Technical details

The vulnerability is an access control bypass in the Edit in-place field module where insufficient authorization checks are performed before allowing entity field modifications. An attacker who possesses the "edit in place field editing permission" role can craft direct requests to modify fields on any entity, circumventing the standard Drupal permission system. The vulnerability affects versions before 2.1.1 and requires the attacker to already hold the specified permission—a mitigation that limits but does not prevent exploitation in environments where multiple user roles have this permission. The fix is available in version 2.1.1 and later.

Affected products

Drupal Edit in-place field 0.0.0 to 2.1.0

Identifiers

CVE-2026-18985
DRUPAL-CONTRIB-2026-093

Timeline

2026-08-05: disclosed
2026-08-05: patched: Version 2.1.1 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.