CVE-2012-5588: The Email Field module 6.x-1.x before 6.x-1.3 for Drupal, when using a field permission module and the fiel...

Security readout for executives and security teams

This issue affects older Drupal sites using the Email Field module 6.x-1.x before 6.x-1.3 in a specific configuration. A permission check failure could let a remote user email a stored address even when field permissions should prevent that. The sources do not show code execution, data theft, or confirmed exploitation. Likely limited to legacy Drupal 6 sites that installed the contributed Email Field module and use the affected formatter with field-level permissions. Modern Drupal sites or sites without that module/configuration are not indicated as affected by the provided sources. Treat this as a targeted legacy cleanup item, not an emergency based on the available evidence. Prioritize internet-facing Drupal 6 properties because the flaw crosses intended permission boundaries and the affected software is old. Mitigation focus: Upgrade Drupal Email Field module to 6.x-1.3 or later.; Check Drupal project advisory guidance for any site-specific remediation notes.; Review full and teaser display modes using the field contact formatter..

Prepared

Jun 24, 2026, 12:04 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.