CVE-2026-107251

Full vulnerability record from the local CVENow database.

Description

Incorrect Authorization vulnerability in Drupal Entity Reference Manager (Merge entities) allows Forceful Browsing. This issue affects Entity Reference Manager (Merge entities) versions: from 0.0.0 to 1.0.3.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

[email protected]

Published

2026-10-30 04:17:45.453000

Last modified

2026-10-30 04:17:45.453000

View original CVE JSON

{
  "id": "CVE-2026-107251",
  "sourceIdentifier": "[email protected]",
  "published": "2026-10-30T04:17:45.453",
  "lastModified": "2026-10-30T04:17:45.453",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Incorrect Authorization vulnerability in Drupal Entity Reference Manager (Merge entities) allows Forceful Browsing. This issue affects Entity Reference Manager (Merge entities) versions: from 0.0.0 to 1.0.3."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Drupal",
          "product": "Entity Reference Manager (Merge entities)",
          "collectionURL": "https://www.drupal.org/project/entity_reference_manager",
          "repo": "https://git.drupalcode.org/project/entity_reference_manager",
          "versions": [
            {
              "version": "0.0.0",
              "lessThan": "1.0.3",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.drupal.org/sa-contrib-2026-194",
      "source": "[email protected]"
    }
  ]
}