CVE-2026-107258

CVE-2026-107258 · DRUPAL-CONTRIB-2026-199

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

This module renders entity add/edit forms inside an AJAX dialog for use with entity reference fields. This module relies only on the "access administration pages" permission, without checking whether the current user had create or update access to the entity itself. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "access administration pages".

Correctif disponible

Publication

2026-10-07T16:22:57Z

Mise à jour

2026-10-07T20:15:05.741633909Z

Pile logicielle: php

Vérifiez votre serveur →