The vulnerability is an incorrect authorization flaw in the Drupal Edit in-place field module that permits forceful browsing. An attacker who can guess or enumerate URLs may reach the edit form for any field or content type, bypassing intended permission checks. This can lead to unauthorized modification of content or discovery of sensitive data. The weakness is mapped to CWE‑863 and CWE‑285.

Drupal sites running the Edit in-place field module between versions 0.0.0 and 2.1.1 are affected. This includes any deployment of Drupal that has the module installed within that version range.

The EPSS score is <1% and the vulnerability is not listed in the CISA KEV catalog, suggesting it may not yet be widely exploited. However, the flaw can be triggered via the web interface without requiring privileged credentials, indicating a low or medium threat depending on site exposure. The CVSS score of 8.1 provides a clear severity assessment, indicating a high risk of unauthorized content modification. The attack vector is inferred to be remote via HTTP requests to the module’s edit URLs.