Authorization Issue in Drupal Entity Reference Manager Product by Drupal
CVE-2026-107251

Currently unrated

Key Information:

Vendor: Drupal
Status: Entity Reference Manager (merge Entities)
Vendor: CVE Published:; 30 October 2026

What is CVE-2026-107251?

An authorization flaw in Drupal's Entity Reference Manager (Merge entities) allows unauthorized users to access and manipulate entities without proper permissions. This vulnerability poses a risk of forceful browsing, enabling attackers to view and modify sensitive data. The affected versions range from 0.0.0 to 1.0.3, making it essential for users to update to the latest version to mitigate potential threats.

Affected Version(s)

Entity Reference Manager (Merge entities) 0.0.0 < 1.0.3

References

https://www.drupal.org/sa-contrib-2026-194

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Oct 30, 2026
Vulnerability Reserved
Oct 7, 2026

Credit

Joshua Sedler (grevil)

Cristiano Demari (cristianodemari)

Joshua Sedler (grevil)

Swan Kalata (akalata)

Greg Knaddison (greggles)

CVE-2026-107251 Data

JSON