Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    Related vulnerabilities

    DRUPAL-CONTRIB-2026-199 (CVE-2026-107258)

    Vulnerability from drupal – Published: 2026-10-07 16:22 – Updated: 2026-10-07 16:22 – Source website
    VLAI
    Details

    This module renders entity add/edit forms inside an AJAX dialog for use with entity reference fields.

    This module relies only on the "access administration pages" permission, without checking whether the current user had create or update access to the entity itself.

    This vulnerability is mitigated by the fact that an attacker must have a role with the permission "access administration pages".

    Credits
    Marcus Johansson (marcus_johansson) www.drupal.org/u/marcus_johansson
    References
    To clipboard 

    {
  "affected": [
    {
      "database_specific": {
        "affected_versions": "\u003c1.0.6"
      },
      "package": {
        "ecosystem": "Packagist:https://packages.drupal.org/8",
        "name": "drupal/inline_entity_form_dialog"
      },
      "ranges": [
        {
          "database_specific": {
            "constraint": "\u003c1.0.6"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": []
    }
  ],
  "aliases": [
    "CVE-2026-107258"
  ],
  "credits": [
    {
      "contact": [
        "https://www.drupal.org/u/marcus_johansson"
      ],
      "name": "Marcus Johansson (marcus_johansson)"
    }
  ],
  "details": "This module renders entity add/edit forms inside an AJAX dialog for use with entity reference fields.\n\nThis module relies only on the \"access administration pages\" permission, without checking whether the current user had create or update access to the entity itself.\n\nThis vulnerability is mitigated by the fact that an attacker must have a role with the permission \"access administration pages\".",
  "id": "DRUPAL-CONTRIB-2026-199",
  "modified": "2026-10-07T16:22:57.000Z",
  "published": "2026-10-07T16:22:57.000Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-contrib-2026-199"
    }
  ],
  "schema_version": "1.7.0"
}