PT-2026-107744

CVE-2026-107251

Published

2026-10-07

Updated

2026-10-30

Description by

CVSS 3.1

6.5

Medium

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Entity Reference Manager (Merge entities) versions 0.0.0 through 1.0.3

Description An incorrect authorization issue in the entity merge functionality allows forceful browsing. The module does not sufficiently restrict access to entity management operations, enabling users with content viewing permissions to delete arbitrary nodes, taxonomy terms, or media entities.

Recommendations Update Entity Reference Manager (Merge entities) to a version later than 1.0.3.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products