CVE-2026-107258

Incorrect Authorization vulnerability in Drupal Inline Entity Form Dialog allows Forceful Browsing. This issue affects Inline Entity Form Dialog versions: from 0.0.0 to 1.0.6...

CVE-2026-107258

The Inline Entity Form Dialog module for Drupal (versions 0.0.0 to 1.0.6 ) is vulnerable to an Incorrect Authorization issue (CWE-863) allowing Forceful Browsing . The root cause is that the module verifies only the "access administration pages" permission without checking if the current user has...

EUVD-2026-113576

Incorrect Authorization vulnerability in Drupal Inline Entity Form Dialog allows Forceful Browsing. This issue affects Inline Entity Form Dialog versions: from 0.0.0 to 1.0.6...

CVE-2026-107258 Inline Entity Form Dialog - Moderately critical - Access bypass - SA-CONTRIB-2026-199

Incorrect Authorization vulnerability in Drupal Inline Entity Form Dialog allows Forceful Browsing. This issue affects Inline Entity Form Dialog versions: from 0.0.0 to 1.0.6...

Inline Entity Form Dialog - Moderately critical - Access bypass - SA-CONTRIB-2026-199

This module renders entity add/edit forms inside an AJAX dialog for use with entity reference fields. This module relies only on the "access administration pages" permission, without checking whether the current user had create or update access to the entity itself. This vulnerability is mitigate...