Project Ricochet's top notch developers, designers and PM’s allowed us to bring our vision of an e-commerce style class search to life. We had a tight budget and a lot of unexpected problems on the Berkeley side. Utilizing Ricochet's state of the art tracking tools and disciplined scrum approach allowed us to surmount every challenge and end up with a fantastic application. We loved the creative collaboration that allowed us to remake a boring campus class schedule into a high-octane search tool that our students and faculty love! Thank you Casey and the whole PR team!
—Johanna Metzgar

Data field - Moderately critical - Information disclosure - SA-CONTRIB-2026-108

Wed, 2026-08-26 10:37 — Anonymous (not verified)

Project: Data fieldDate: 2026-August-26Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:AllVulnerability: Information disclosureAffected versions: <2.0.13CVE IDs: CVE-2026-81269Description: This module enables you to store structured data in configurable fields and expose Data Field values through JSON endpoints.
The module doesn't sufficiently check access when returning Data Field values through its JSON endpoint. This may allow anonymous users to access field values belonging to entities they cannot otherwise view, including unpublished content.Solution: Install the latest version:

If you use the Data Field module, upgrade to Data Field 2.0.13

Reported By:

Marcus Johansson (marcus_johansson)
Drew Webber (mcdruid) of the Drupal Security Team
Steven Jones (steven jones)

Fixed By:

Coordinated By:

Swan Kalata (akalata) of the Drupal Security Team
David Stoline (dstol)
Greg Knaddison (greggles) of the Drupal Security Team
Drew Webber (mcdruid) of the Drupal Security Team
Juraj Nemec (poker10) of the Drupal Security Team
Jess (xjm) of the Drupal Security Team

Path to article https://www.drupal.org/sa-contrib-2026-108

Search form

Data field - Moderately critical - Information disclosure - SA-CONTRIB-2026-108