---
id: "CVE-2026-107251"
kind: "vulnerability"
aliases: ["CVE-2026-107251"]
title: "Drupal Entity Reference Manager: incorrect authorization allows forceful browsing of merge"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["drupal", "entity-reference-manager", "package"]
not_affected_if: ["module-not-installed"]
published_at: "2026-10-30T04:17:45+00:00"
first_seen_at: "2026-10-30T04:28:35+00:00"
updated_at: "2026-10-30T04:31:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107251", "first_seen_at": "2026-10-30T04:28:35+00:00"}]
---

# Drupal Entity Reference Manager: incorrect authorization allows forceful browsing of merge

The Drupal Entity Reference Manager module's merge entities feature has an incorrect authorization flaw. An attacker can reach its pages directly by forceful browsing, without the permission checks the feature should enforce.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the Drupal site has the Entity Reference Manager module installed and at what version (for example `drush pm:list --filter=entity_reference_manager`, if Drush is available).

## Fix

- Entity Reference Manager versions from 0.0.0 to 1.0.3 are affected; the sources do not state a fixed version.

## Timeline

- 2026-10-30T04:28:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107251

## From the sources

Incorrect Authorization vulnerability in Drupal Entity Reference Manager (Merge entities) allows Forceful Browsing. This issue affects Entity Reference Manager (Merge entities) versions: from 0.0.0 to 1.0.3.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_