medium6.5
CVE-2026-107251
Incorrect Authorization vulnerability in Drupal Entity Reference Manager (Merge entities) allows Forceful Browsing.
Impact
Incorrect Authorization vulnerability in Drupal Entity Reference Manager (Merge entities) allows Forceful Browsing. This issue affects Entity Reference Manager (Merge entities) versions: from 0.0.0 to 1.0.3.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Drupal | Entity Reference Manager (Merge Entities) | from 0.0.0 before 1.0.3 |