# CVE-2026-81269: Drupal Data field missing authorization in JSON endpoint

Source: https://junglewise.ai/threats/cve-2026-81269-drupal-data-field-missing-authorization-in-json-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-81269 · Severity: medium · CVSS 5.3 · Published 2026-09-02

The Drupal Data field module is a plugin that stores and exposes structured custom field data through JSON endpoints. A missing authorization check in the JSON endpoint allows unauthenticated users to bypass access controls and view sensitive field values, including unpublished content they should not be able to access.

Technologies: [Packagist:Https://Packages.Drupal.Org/8 Drupal/Datafield](https://junglewise.ai/threats/technologies/drupal-datafield). Vendors: [Packagist:Https://Packages.Drupal.Org/8](https://junglewise.ai/threats/vendors/packagist-https-packages-drupal-org-8).

## Quick answers

**Is CVE-2026-81269 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-81269 being exploited in the wild.

**How severe is CVE-2026-81269?** Medium severity, with a CVSS score of 5.3, published 2 September 2026.

**Which products and versions are affected?** Packagist:Https://Packages.Drupal.Org/8 Drupal/Datafield ECOSYSTEM:introduced=0,fixed=2.0.13.

**Is there a fix for CVE-2026-81269?** Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Datafield: upgrade to 2.0.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-81269 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-81269?** Check whether you run Data Field Project Data Field or Packagist:Https://Packages.Drupal.Org/8 Drupal/Datafield at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Packagist:Https://Packages.Drupal.Org/8 Drupal/Datafield: upgrade to 2.0.13 or later

## Technical details

The Data field module fails to properly check user permissions when returning field values through its JSON API endpoint. This is an authorization bypass vulnerability affecting the module's REST/JSON exposure layer. An unauthenticated attacker can directly query the endpoint to retrieve field data from entities (nodes, users, taxonomy terms, etc.) they do not have permission to view, including unpublished content. No authentication or user interaction is required; the vulnerability is exploitable by sending HTTP requests to the JSON endpoint. The fix is available in version 2.0.13, which adds appropriate access control checks.

## Affected products

- Drupal Data field < 2.0.13

## Identifiers

- CVE-2026-81269
- DRUPAL-CONTRIB-2026-108

## Timeline

- 2026-08-26: disclosed
- 2026-08-26: patched: Version 2.0.13 released with fix

## References

- [https://www.drupal.org/project/datafield](https://www.drupal.org/project/datafield)
- [https://www.drupal.org/sa-contrib-2026-108](https://www.drupal.org/sa-contrib-2026-108)

## Related threats

- [Drupal Data Field cross-site scripting in autocomplete](https://junglewise.ai/threats/cve-2026-126760-drupal-contrib-2026-339-this-module-provides-a-field-type-for)
- [Drupal Data Field cross-site scripting in file_uri formatter](https://junglewise.ai/threats/cve-2026-114555-drupal-contrib-2026-250-data-field-allows-you-to-create-custom)
- [DRUPAL-CONTRIB-2023-040 - The Data Field module provides a way of building field types that are made up of other…](https://junglewise.ai/threats/drupal-contrib-2023-040-the-data-field-module-provides-a-way-of-7dd3ec8b)