Inline Entity Form Dialog
Monthly
Authenticated low-privileged users can bypass intended authorization checks in Drupal's Inline Entity Form Dialog contributed module (versions 0.0.0 through 1.0.6 per the CVE description), using forceful browsing to reach restricted functionality with limited confidentiality and integrity impact. The flaw requires the module to be installed and enabled plus a valid low-privilege session (CVSS PR:L), so anonymous exploitation is not possible unless the site grants the needed role to self-registered users. No public exploit was identified at time of analysis and there is no CISA KEV entry; EPSS is 0.14% (percentile 4%), and the vendor has a patch available, making this a moderate, this-month priority rather than an emergency.
Authenticated low-privileged users can bypass intended authorization checks in Drupal's Inline Entity Form Dialog contributed module (versions 0.0.0 through 1.0.6 per the CVE description), using forceful browsing to reach restricted functionality with limited confidentiality and integrity impact. The flaw requires the module to be installed and enabled plus a valid low-privilege session (CVSS PR:L), so anonymous exploitation is not possible unless the site grants the needed role to self-registered users. No public exploit was identified at time of analysis and there is no CISA KEV entry; EPSS is 0.14% (percentile 4%), and the vendor has a patch available, making this a moderate, this-month priority rather than an emergency.