PatchClock

PHP security digest · 7 Oct 2026

Entity Reference Manager is an advanced administrative module for Drupal that allows site administrators to identify, analyze, and replace entity references acr...

Unrated CVE-2026-107251

Package
drupal/entity_reference_manager
Fixed in
1.0.3
Published
Wed 7 Oct 2026, 17:16 LisbonUpdated Mon 26 Oct 2026, 04:26 Lisbon

In plain words

Entity Reference Manager does not sufficiently restrict access to entity management operations. Users who can view content can access the entity merge functionality and delete arbitrary nodes, taxonomy terms or media entities.

Am I affected?

Look for drupal/entity_reference_manager and its version in composer.lock. The advisory lists 1.0.3 as fixed but gives no affected version range. Check whether users who can view content can also access the module's entity merge functionality.

What to do

Check which version you have, then update to a fixed release for your branch (1.0.3):

composer show drupal/entity_reference_manager | grep versions
composer update drupal/entity_reference_manager

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

The advisory's description

Entity Reference Manager is an advanced administrative module for Drupal that allows site administrators to identify, analyze, and replace entity references across the system.

The module does not sufficiently restrict access to all entity management operations. Users who can view content can access the entity merge functionality and delete arbitrary nodes, taxonomy terms, or media entities.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.