🔐 CVE Alert

CVE-2026-107251

UNKNOWN 0.0

Entity Reference Manager (Merge entities) - Critical - Access bypass - SA-CONTRIB-2026-194

CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th

Incorrect Authorization vulnerability in Drupal Entity Reference Manager (Merge entities) allows Forceful Browsing. This issue affects Entity Reference Manager (Merge entities) versions: from 0.0.0 to 1.0.3.

CWE CWE-863
Vendor drupal
Product entity reference manager (merge entities)
Ecosystems
Industries
WebMedia
Published Oct 30, 2026
Stay Ahead of the Next One

Get instant alerts for drupal entity reference manager (merge entities)

Be the first to know when new unknown vulnerabilities affecting drupal entity reference manager (merge entities) are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Drupal / Entity Reference Manager (Merge entities)
0.0.0 < 1.0.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗
drupal.org: https://www.drupal.org/sa-contrib-2026-194

Credits

Joshua Sedler (grevil) Cristiano Demari (cristianodemari) Joshua Sedler (grevil) Swan Kalata (akalata) Greg Knaddison (greggles)