{"id":"CVE-2026-107258","kind":"vulnerability","aliases":["CVE-2026-107258"],"related":[],"title":"Drupal Inline Entity Form Dialog: incorrect authorization allows forceful browsing","description":"Incorrect Authorization vulnerability in Drupal Inline Entity Form Dialog allows Forceful Browsing. This issue affects Inline Entity Form Dialog versions: from 0.0.0 to 1.0.6.","summary":"The Drupal Inline Entity Form Dialog module has an incorrect authorization flaw that lets a user reach pages they should not access by forceful browsing. The sources affect versions from 0.0.0 to 1.0.6 and give no details on what data or actions are exposed.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","inline-entity-form-dialog","package"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed version of the Inline Entity Form Dialog module in the Drupal project (for example with `drush pm:list` or the module list in Drupal admin).","fix":"- Move to a version later than `1.0.6`; the sources do not name the fixed version.","status":"open","published_at":"2026-10-30T04:17:54+00:00","first_seen_at":"2026-10-30T04:28:35+00:00","triaged_at":"2026-10-30T04:31:38+00:00","updated_at":"2026-10-30T04:31:38+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-30T04:31:38Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a version later than `1.0.6`; the sources do not name the fixed version.","reach":"internet","title":"Drupal Inline Entity Form Dialog: incorrect authorization allows forceful browsing","impact":"medium","summary":"The Drupal Inline Entity Form Dialog module has an incorrect authorization flaw that lets a user reach pages they should not access by forceful browsing. The sources affect versions from 0.0.0 to 1.0.6 and give no details on what data or actions are exposed.","audience":"businesses","category":"package","nicknames":[],"who_cares":["drupal","inline-entity-form-dialog"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown access to restricted Drupal pages or entity forms","analyst_note":"Find the fixed version and the NVD/Drupal security advisory details on required role and which pages are exposed.","how_to_check":"- Check the installed version of the Inline Entity Form Dialog module in the Drupal project (for example with `drush pm:list` or the module list in Drupal admin).\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Drupal sites running the Inline Entity Form Dialog module at version 1.0.6 or earlier are in the affected range. The sources do not say which configurations or roles are needed to reach the flaw, so unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00068,"input_tokens":4099,"output_tokens":541,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107258':13A,16A '-2026':12A,15A '0.0.0':54B,89C '1.0.6':56B,91C 'access':45B 'action':65B 'affect':51B,82C 'allow':8A,77C 'author':7A,34B,69C 'brows':10A,48B,79C 'cve':11A,14A 'data':63B 'detail':60B 'dialog':5A,22B,29B,76C,86C 'drupal':1A,17B,25B,72C 'entiti':3A,20B,27B,74C,84C 'expos':67B 'flaw':35B 'forc':9A,47B,78C 'form':4A,21B,28B,75C,85C 'give':58B 'incorrect':6A,33B,68C 'inlin':2A,19B,26B,73C,83C 'inline-entity-form-dialog':18B 'issu':81C 'let':37B 'modul':30B 'packag':23B 'page':41B 'reach':40B 'sourc':50B 'user':39B 'version':52B,87C 'vulner':70C","nicknames":[],"mitigations":[],"who_affected":"Drupal sites running the Inline Entity Form Dialog module at version 1.0.6 or earlier are in the affected range. The sources do not say which configurations or roles are needed to reach the flaw, so unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:17:54+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107258","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107258","severity":null,"published_at":"2026-10-30T04:17:54+00:00","modified_at":"2026-10-30T04:17:54+00:00","first_seen_at":"2026-10-30T04:28:35+00:00","fetched_at":"2026-10-30T04:28:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}