Inline Entity Form Dialog - Moderately critical - Access bypass - SA-CONTRIB-2026-199

Inline Entity Form Dialog · Incorrect authorization · CWE-863

AffectedInline Entity Form Dialog

FixUpdate to 1.0.6 or newer

PublishedOct 30, 03:10 · drupal

Scored5.4 · CISA

Exploit code publicNone known · checked 21:18 UTC

ExploitedNone known · CISA KEV checked 22:08 UTC

What we know

No known exploitation. CISA KEV, checked 22:08 UTC.

No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.

An attacker needs network access and an account. CVSS: network, low privileges.

Description

Incorrect Authorization vulnerability in Drupal Inline Entity Form Dialog allows Forceful Browsing. This issue affects Inline Entity Form Dialog versions: from 0.0.0 to 1.0.6.

From drupal

Affected and fixed versions

ProductAffectedFixed inInline Entity Form Dialog0.0.0 – before 1.0.61.0.6

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known