Entity Reference Manager Merge Entities
Monthly
Drupal's Entity Reference Manager contrib module (Merge entities submodule) versions 0.0.0 through 1.0.3 fail to enforce proper authorization on its merge-entity functionality, allowing forceful browsing to reach routes a user should not be permitted to access. Sites are affected only where this optional contrib module is installed and enabled; impact is limited to partial confidentiality and integrity with no availability effect, and the trigger conditions are not fully described in the available sources. No KEV listing or confirmed public exploit code exists, EPSS is low at 0.15% (5th percentile), and a vendor patch is available.
Drupal's Entity Reference Manager contrib module (Merge entities submodule) versions 0.0.0 through 1.0.3 fail to enforce proper authorization on its merge-entity functionality, allowing forceful browsing to reach routes a user should not be permitted to access. Sites are affected only where this optional contrib module is installed and enabled; impact is limited to partial confidentiality and integrity with no availability effect, and the trigger conditions are not fully described in the available sources. No KEV listing or confirmed public exploit code exists, EPSS is low at 0.15% (5th percentile), and a vendor patch is available.