Live › vulnerability › CVE-2026-107251
The Drupal Entity Reference Manager module's merge entities feature has an incorrect authorization flaw. An attacker can reach its pages directly by forceful browsing, without the permission checks the feature should enforce.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Drupal sites that run the Entity Reference Manager module with its merge entities feature. The sources do not say which roles or configurations are needed, so unknown.
No product ranges from the sources yet.
drush pm:list --filter=entity_reference_manager, if Drush is available).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incorrect Authorization vulnerability in Drupal Entity Reference Manager (Merge entities) allows Forceful Browsing. This issue affects Entity Reference Manager (Merge entities) versions: from 0.0.0 to 1.0.3.
This page as .md · .json · in your agent: get_signal("CVE-2026-107251")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.