Inline Entity Form Dialog CVE-2026-107258

Requires a Drupal site with the Inline Entity Form Dialog contributed module installed and enabled at a version below 1.0.6, plus an authenticated low-privileged account on that site (PR:L) - exploitation is not possible for fully unauthenticated, anonymous visitors unless the site grants the relevant role to self-registered users. The specific feature path or endpoint whose authorization is incorrectly enforced is not detailed in the available sources (the advisory body was not provided); the vulnerability is described only as Incorrect Authorization enabling Forceful Browsing. Limiting factors: dependency on this specific contrib module being present, the requirement for a valid authenticated session, and partial (C:L/I:L, A:N) impact rather than full compromise.

This is a moderate-severity (CVSS 5.4), low-urgency authorization flaw rather than a top-priority emergency. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates a network-reachable, low-complexity issue requiring an already-authenticated low-privileged account (PR:L), with partial confidentiality and integrity impact and no availability impact (C:L/I:L/A:N) and no scope change (S:U). The signals are internally consistent and point away from mass exploitation: EPSS is just 0.14% (4th percentile), there is no CISA KEV listing, and no public exploit or PoC reference appears in the input. The vuln.today decision label is 'this_month', which aligns with a routine-patch posture rather than act_now/emergency. The main caveat is scope of affected software: this is a Drupal contributed module, not Drupal core, so blast radius depends on how many sites have specifically installed the Inline Entity Form Dialog module. No conflicting signals are present; the chief limitation is that the Drupal security advisory (SA-CONTRIB-2026-199) content was not provided, so the precise mechanism of the forceful-browsing/authorization bypass is not detailed in the available sources.

An attacker who already holds a low-privileged authenticated account on a Drupal site running the Inline Entity Form Dialog module directly requests a form or entity endpoint whose authorization check is incorrectly enforced (forceful browsing). Because the authorization control can be bypassed, the attacker views or modifies entity data they should not be permitted to reach, consistent with the limited confidentiality and integrity impact (C:L/I:L). No public exploit code or PoC reference is present in the input, and exploitation requires authentication, which limits realistic abuse to users who can register or obtain accounts.