{"id":"CVE-2026-107251","kind":"vulnerability","aliases":["CVE-2026-107251"],"related":[],"title":"Drupal Entity Reference Manager: incorrect authorization allows forceful browsing of merge","description":"Incorrect Authorization vulnerability in Drupal Entity Reference Manager (Merge entities) allows Forceful Browsing. This issue affects Entity Reference Manager (Merge entities) versions: from 0.0.0 to 1.0.3.","summary":"The Drupal Entity Reference Manager module's merge entities feature has an incorrect authorization flaw. An attacker can reach its pages directly by forceful browsing, without the permission checks the feature should enforce.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","entity-reference-manager","package"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check whether the Drupal site has the Entity Reference Manager module installed and at what version (for example `drush pm:list --filter=entity_reference_manager`, if Drush is available).","fix":"- Entity Reference Manager versions from 0.0.0 to 1.0.3 are affected; the sources do not state a fixed version.","status":"open","published_at":"2026-10-30T04:17:45+00:00","first_seen_at":"2026-10-30T04:28:35+00:00","triaged_at":"2026-10-30T04:31:45+00:00","updated_at":"2026-10-30T04:31:45+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-30T04:31:45Z","model":"claude-haiku-5-5","output":{"fix":"- Entity Reference Manager versions from 0.0.0 to 1.0.3 are affected; the sources do not state a fixed version.","reach":"internet","title":"Drupal Entity Reference Manager: incorrect authorization allows forceful browsing of merge","impact":"medium","summary":"The Drupal Entity Reference Manager module's merge entities feature has an incorrect authorization flaw. An attacker can reach its pages directly by forceful browsing, without the permission checks the feature should enforce.","audience":"businesses","category":"package","nicknames":[],"who_cares":["drupal","entity-reference-manager"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown; an attacker may reach merge entity functions without authorization","analyst_note":"Confirm the fixed version and the required permissions from the Drupal security advisory for Entity Reference Manager.","how_to_check":"- Check whether the Drupal site has the Entity Reference Manager module installed and at what version (for example `drush pm:list --filter=entity_reference_manager`, if Drush is available).\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Drupal sites that run the Entity Reference Manager module with its merge entities feature. The sources do not say which roles or configurations are needed, so unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000673,"input_tokens":4111,"output_tokens":524,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107251':14A,17A '-2026':13A,16A '0.0.0':80C '1.0.3':82C 'affect':72C 'allow':7A,67C 'attack':40B 'author':6A,37B,58C 'brows':9A,48B,69C 'check':52B 'cve':12A,15A 'direct':45B 'drupal':1A,18B,25B,61C 'enforc':56B 'entiti':2A,20B,26B,32B,62C,66C,73C,77C 'entity-reference-manag':19B 'featur':33B,54B 'flaw':38B 'forc':8A,47B,68C 'incorrect':5A,36B,57C 'issu':71C 'manag':4A,22B,28B,64C,75C 'merg':11A,31B,65C,76C 'modul':29B 'packag':23B 'page':44B 'permiss':51B 'reach':42B 'refer':3A,21B,27B,63C,74C 'version':78C 'vulner':59C 'without':49B","nicknames":[],"mitigations":[],"who_affected":"Drupal sites that run the Entity Reference Manager module with its merge entities feature. The sources do not say which roles or configurations are needed, so unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:17:45+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107251","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107251","severity":null,"published_at":"2026-10-30T04:17:45+00:00","modified_at":"2026-10-30T04:17:45+00:00","first_seen_at":"2026-10-30T04:28:35+00:00","fetched_at":"2026-10-30T04:28:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}