Unauthorized Access Issue in Drupal Inline Entity Form Dialog
CVE-2026-107258

Currently unrated

Key Information:

Vendor

Drupal
Status
Inline Entity Form Dialog
Vendor
CVE Published:
30 October 2026

What is CVE-2026-107258?

The Inline Entity Form Dialog in Drupal is subject to an Incorrect Authorization vulnerability, which can lead to forceful browsing. This flaw allows unauthorized users to access restricted areas of the application if they manipulate the URL or the request parameters. Versions affected range from 0.0.0 to 1.0.6, highlighting the importance of ensuring proper authorization checks in the application code to prevent security breaches.

Affected Version(s)

Inline Entity Form Dialog 0.0.0 < 1.0.6

References

https://www.drupal.org/sa-contrib-2026-199

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Marcus Johansson (marcus_johansson)
Marcus Johansson (marcus_johansson)
Zeeshaan khann (zeeshan_khan)
Swan Kalata (akalata)
Juraj Nemec (poker10)
.