CVE-2026-107258

Name of the Vulnerable Software and Affected Versions Inline Entity Form Dialog versions 0.0.0 through 1.0.6

Description An incorrect authorization issue allows forceful browsing. The module renders entity add/edit forms within an AJAX dialog for entity reference fields but relies solely on the "access administration pages" permission. It fails to verify if the current user possesses the necessary create or update access for the specific entity. This issue is mitigated if the attacker does not have a role assigned with the "access administration pages" permission.

Recommendations Update Inline Entity Form Dialog to a version later than 1.0.6.