Drupal Entity Reference Manager CVE-2026-107251

Exploitation requires the Drupal 'Entity Reference Manager (Merge entities)' contrib module to be installed and enabled at a version in the range 0.0.0 through 1.0.2 (fixed in 1.0.3), and the attacker must reach the module's merge-entity functionality via its exposed route. The CVSS vector indicates no privileges and no user interaction (PR:N/UI:N) over the network, implying default-reachable endpoints; however, the sources do not specify the exact endpoint or whether a logged-in session is needed, so the unauthenticated assumption should be confirmed against the vendor advisory. Limiting factors: the flaw only exists where this specific contrib module is deployed, and impact is capped at partial confidentiality and integrity with no availability effect.

This is a moderate-severity, low-urgency issue rather than a top priority. The input CVSS of 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) describes a network-reachable, low-complexity authorization flaw with no privileges or user interaction required and only partial confidentiality and integrity impact (no availability impact). EPSS is very low at 0.15% (5th percentile), the CVE is NOT listed in CISA KEV, and no verified working exploit code is referenced - only a vuldb advisory entry. The vuln.today decision label is 'this_month', consistent with a real but non-emergency fix window. Signals are coherent and point the same direction: genuine authorization weakness but limited real-world pressure. The main caveat is mechanism: the description labels this 'Forceful Browsing' under CWE-863 (Incorrect Authorization), but the sources do not state exactly which merge-entity endpoint or operation lacks the authorization check, nor whether any authenticated session is needed to reach it, so the PR:N assumption should be verified against the Drupal advisory (sa-contrib-2026-194).

An attacker directly requests the module's merge-entity URLs/endpoints, and because the authorization check is missing or incorrect, they reach functionality or data that should be restricted (forceful browsing). This permits unauthorized viewing or modification of referenced entity data (C:L/I:L). No public exploit code is referenced, so exploitation would require manually identifying the vulnerable endpoint from the module's routes.