Live › vulnerability › CVE-2026-107258
The Drupal Inline Entity Form Dialog module has an incorrect authorization flaw that lets a user reach pages they should not access by forceful browsing. The sources affect versions from 0.0.0 to 1.0.6 and give no details on what data or actions are exposed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Drupal sites running the Inline Entity Form Dialog module at version 1.0.6 or earlier are in the affected range. The sources do not say which configurations or roles are needed to reach the flaw, so unknown.
No product ranges from the sources yet.
drush pm:list or the module list in Drupal admin).1.0.6; the sources do not name the fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incorrect Authorization vulnerability in Drupal Inline Entity Form Dialog allows Forceful Browsing. This issue affects Inline Entity Form Dialog versions: from 0.0.0 to 1.0.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-107258")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.