{"id":"DRUPAL-CONTRIB-2026-108","details":"This module enables you to store structured data in configurable fields and expose Data Field values through JSON endpoints.\n\nThe module doesn't sufficiently check access when returning Data Field values through its JSON endpoint. This may allow anonymous users to access field values belonging to entities they cannot otherwise view, including unpublished content.","aliases":["CVE-2026-81269"],"modified":"2026-09-02T19:55:29.393088595Z","published":"2026-08-26T17:37:11Z","references":[{"type":"WEB","url":"https://www.drupal.org/sa-contrib-2026-108"}],"affected":[{"package":{"name":"drupal/datafield","ecosystem":"Packagist:https://packages.drupal.org/8","purl":"pkg:composer/drupal/datafield?repository_url=https:%2F%2Fpackages.drupal.org%2F8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.13"}],"database_specific":{"constraint":"\u003c2.0.13"}}],"database_specific":{"affected_versions":"\u003c2.0.13","source":"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/datafield/DRUPAL-CONTRIB-2026-108.json"}}],"schema_version":"1.9.0","credits":[{"name":"Drew Webber (mcdruid)","contact":["https://www.drupal.org/u/mcdruid"]},{"name":"Marcus Johansson (marcus_johansson)","contact":["https://www.drupal.org/u/marcus_johansson"]},{"name":"Steven Jones (steven jones)","contact":["https://www.drupal.org/u/steven-jones"]}]}