PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-87955 Drupal CVE debrief

A Missing Authorization vulnerability in Drupal Ultimate Table Field allows Forceful Browsing. The issue affects Ultimate Table Field versions from 0.0.0 to 1.1.1 and from 2.0.0 to 2.0.1. This vulnerability impacts Drupal installations, allowing unauthorized access. Defenders should verify exposure and apply patches to prevent potential security incidents. The CVE record and source item provide details on the vulnerability and affected versions, but CVSS score and severity are not provided.

Vendor
Drupal
Product
Ultimate Table Field
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-22
Original CVE updated
2026-10-22
Advisory published
2026-10-22
Advisory updated
2026-10-22

Who should care

Defenders responsible for Drupal installations with Ultimate Table Field versions 0.0.0 to 1.1.1 and 2.0.0 to 2.0.1 should verify exposure and apply patches.

Why it matters

The CVE-2026-87955 vulnerability in Ultimate Table Field allows Forceful Browsing, impacting Drupal installations. Defenders should verify exposure, apply patches, and monitor for potential security incidents.

  • Verify exposure of Ultimate Table Field instances to potential Forceful Browsing attempts.
  • Apply patches or updates to prevent unauthorized access.
  • Monitor for potential security incidents related to this vulnerability.

Technical summary

The Ultimate Table Field module for Drupal has a Missing Authorization vulnerability, allowing Forceful Browsing. The vulnerability affects versions from 0.0.0 to 1.1.1 and from 2.0.0 to 2.0.1. This vulnerability impacts Drupal installations, allowing unauthorized access. The issue arises from a lack of proper authorization checks in the Ultimate Table Field module. Defenders should prioritize verifying exposure and applying patches for Ultimate Table Field versions 0.0.0 to 1.1.1 and 2.0.0 to 2.0.1.

Defensive priority

Defenders should prioritize verifying exposure and applying patches for Ultimate Table Field versions 0.0.0 to 1.1.1 and 2.0.0 to 2.0.1.

Recommended defensive actions

  • Verify exposure of Ultimate Table Field versions 0.0.0 to 1.1.1 and 2.0.0 to 2.0.1 in your environment.
  • Apply patches or updates for Ultimate Table Field as provided by the vendor.
  • Monitor for potential Forceful Browsing attempts on Ultimate Table Field instances.

Evidence notes

The CVE record and source item provide details on the vulnerability and affected versions. However, CVSS score and severity are not provided. The vulnerability allows Forceful Browsing, impacting Drupal installations with Ultimate Table Field versions from 0.0.0 to 1.1.1 and from 2.0.0 to 2.0.1. Defenders should verify exposure, apply patches, and monitor for potential security incidents related to this vulnerability. The source item provides details on the vulnerability and affected,

Sources and references

Verified primary and authoritative sources

  • CVE-2026-87955 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-87955

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-87955 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-87955

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.