{"id":"CVE-2026-18985","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-18985","summary":null,"details":"This module provides formatters to allow in-place editing in a View or other display (full content, teaser...).\n\nThe module doesn't sufficiently check access when editing entities. A malicious user could craft requests to allow them to modify any field on any entity.\n\nThis vulnerability is mitigated by the fact that an attacker must have a role with the permission \"edit in place field editing permission\".","published":"2026-08-05T17:58:38Z","modified":"2026-08-05T19:30:06.183148208Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Packagist:https://packages.drupal.org/8","name":"drupal/edit_in_place_field","fixedVersion":"2.1.1"}],"fix":null,"references":[{"type":"WEB","url":"https://www.drupal.org/sa-contrib-2026-093"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-05T19:30:06.183148208Z"}}