Quick answers
- Is CVE-2026-81269 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-81269 being exploited in the wild.
- How severe is CVE-2026-81269?
- Medium severity, with a CVSS score of 5.3, published 2 September 2026.
- Which products and versions are affected?
- Packagist:Https://Packages.Drupal.Org/8 Drupal/Datafield ECOSYSTEM:introduced=0,fixed=2.0.13.
- Is there a fix for CVE-2026-81269?
- Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Datafield: upgrade to 2.0.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-81269 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-81269?
- Check whether you run Data Field Project Data Field or Packagist:Https://Packages.Drupal.Org/8 Drupal/Datafield at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Packagist:Https://Packages.Drupal.Org/8 Drupal/Datafield: upgrade to 2.0.13 or later
Technical details
The Data field module fails to properly check user permissions when returning field values through its JSON API endpoint. This is an authorization bypass vulnerability affecting the module's REST/JSON exposure layer. An unauthenticated attacker can directly query the endpoint to retrieve field data from entities (nodes, users, taxonomy terms, etc.) they do not have permission to view, including unpublished content. No authentication or user interaction is required; the vulnerability is exploitable by sending HTTP requests to the JSON endpoint. The fix is available in version 2.0.13, which adds appropriate access control checks.
Affected products
- Drupal Data field < 2.0.13
Identifiers
- CVE-2026-81269
- DRUPAL-CONTRIB-2026-108
Timeline
- 2026-08-26: disclosed
- 2026-08-26: patched: Version 2.0.13 released with fix