CVE-2026-87955 Details
Description
Missing Authorization vulnerability in Drupal Ultimate Table Field allows Forceful Browsing. This issue affects Ultimate Table Field versions: from 0.0.0 to 1.1.1, from 2.0.0 to 2.0.1.
A missing authorization vulnerability has been identified in the Drupal Ultimate Table Field module, specifically in versions 0.0.0 through 1.1.1 and 2.0.0 through 2.0.1. This vulnerability allows for forceful browsing by bypassing access controls. The issue arises because the module does not adequately protect the route that opens the cell editor dialog, making it accessible to anonymous users. Exploitation of this vulnerability enables unauthorized users to upload files to the server, although only files with PDF, DOC, and DOCX extensions are accepted.
Users of the Ultimate Table Field module should upgrade to version 2.0.1 if they are on the 2.x branch, or to version 1.1.1 if they are on the 1.x branch. After updating, the new permission 'Use the Ultimate Table Field cell editor' should be granted to every role that edits content with an Ultimate Table field. This step is crucial, as the latest version removes the default permission for all roles.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 22, 2026CISA-ADP
Assessed Oct 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.drupal.org/sa-contrib-2026-153 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Drupal Ultimate Table Field | < 1.1.1 (semver) >= 2.0.0, < 2.0.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 22, 2026 | CVE Modified | CISA-ADP |
| Oct 22, 2026 | New CVE Received | [email protected] |