CVE-2026-107251

MediumCVSS 6.5/10Last modified Oct 30, 2026

Description

Incorrect Authorization vulnerability in Drupal Entity Reference Manager (Merge entities) allows Forceful Browsing. This issue affects Entity Reference Manager (Merge entities) versions: from 0.0.0 to 1.0.3.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-863

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
DrupalEntity Reference Manager (Merge entities)>= 0.0.0, < 1.0.3

References

Timeline

Published
Oct 30, 2026
Last modified
Oct 30, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1072525.4Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal MathJax: LaTeX for Drupal allowCVE-2026-1072535.9Vulnerability in Drupal Orphans Media. This issue affects Orphans Media versions: *.*.CVE-2026-1072544.8Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication BypassCVE-2026-1072557.3Incorrect Authorization vulnerability in Drupal Restrict route by IP allows Forceful Browsing. This issue affects Restrict route by IP versiCVE-2026-1072565.3Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Shield allows Brute Force. This issue affects Shield versiCVE-2026-1072576.5Incorrect Authorization vulnerability in Drupal Actstream allows Forceful Browsing. This issue affects Actstream versions: from 0.0.0 to 2.0CVE-2026-1072585.4Incorrect Authorization vulnerability in Drupal Inline Entity Form Dialog allows Forceful Browsing. This issue affects Inline Entity Form DiCVE-2026-1072595.4Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Linked Field allows Code Injection. This issueCVE-2026-107266.8Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclosure vulnerability. A low-privileged local user can cause theCVE-2026-1072606.5Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Sector Distribution allows StorCVE-2026-1072614.2Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication BypassCVE-2026-1072625.3Cross-Site Request Forgery (CSRF) vulnerability in Drupal Advanced Filesystem allows Cross Site Request Forgery. This issue affects Advanced
CVE-2026-107251: Medium severity, CVSS 6.5 | Vulnix