CVE-2026-107251: Entity Reference Manager (Merge entities) - Critical - Access bypass - SA-CONTRIB-2026-194
Published Oct 30, 2026
·Updated
Incorrect Authorization vulnerability in Drupal Entity Reference Manager (Merge entities) allows Forceful Browsing. This issue affects Entity Reference Manager (Merge entities) versions: from 0.0.0 to 1.0.3.
Event History
Oct 30, 2026
CVE Published
via MITRE·03:10 AM
Data Sourced
via MITRE·03:10 AM
DescriptionWeakness
Data Sourced
via NVD·04:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The vulnerability is remotely exploitable over the network with low attack complexity. The vector indicates that no privileges and no user interaction are required.
2
How can I determine whether an installation is in scope?
An installation is affected if it uses Entity Reference Manager (Merge entities) in the reported version range from 0.0.0 through 1.0.3.
3
What is the expected impact if exploitation succeeds?
The reported vector indicates low confidentiality and low integrity impact, with no availability impact.