CVE-2026-107258: Inline Entity Form Dialog - Moderately critical - Access bypass - SA-CONTRIB-2026-199
Published Oct 30, 2026
·Updated
Incorrect Authorization vulnerability in Drupal Inline Entity Form Dialog allows Forceful Browsing. This issue affects Inline Entity Form Dialog versions: from 0.0.0 to 1.0.6.
Event History
Oct 30, 2026
CVE Published
via MITRE·03:10 AM
Data Sourced
via MITRE·03:10 AM
DescriptionWeakness
Data Sourced
via NVD·04:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are affected?
Drupal sites using Inline Entity Form Dialog versions from 0.0.0 through 1.0.6 are affected.
2
What level of access does an attacker need?
The vulnerability requires low privileges. It is remotely reachable, has low attack complexity, and does not require user interaction.
3
What impact can successful exploitation have?
Successful forceful browsing can bypass authorization controls and cause limited confidentiality and integrity impact. No availability impact is indicated.