—
DRUPAL-CONTRIB-2026-108
Details
This module enables you to store structured data in configurable fields and expose Data Field values through JSON endpoints.
The module doesn't sufficiently check access when returning Data Field values through its JSON endpoint. This may allow anonymous users to access field values belonging to entities they cannot otherwise view, including unpublished content.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist:https://packages.drupal.org/8 / drupal/datafield
Introduced in:
0 Fixed in: 2.0.13 Upgrade drupal/datafield to 2.0.13 or newer (ecosystem packagist:https://packages.drupal.org/8).