CVE-2026-18985: Drupal Edit In-Place Field

High severity, CVSS 8.1. EPSS: 0.2% chance of exploitation in the next 30 days.

Incorrect Authorization vulnerability in Drupal Edit in-place field allows Forceful Browsing. This issue affects Edit in-place field versions: from 0.0.0 to 2.1.1.

Affected products

• Drupal Edit In-Place Field: from 0.0.0, before 2.1.1 (fixed in 2.1.1)

Published 2026-08-25. Last modified 2026-08-28.