This module renders entity add/edit forms inside an AJAX dialog for use with entity reference fields. This module relies only on the "access administration pag...

The module lets users create or edit entities through an AJAX dialog without checking whether they have permission to create or update those entities. An attacker must have a role with the access administration pages permission.

Look for drupal/inline_entity_form_dialog and its version in composer.lock. The fixed version is 1.0.6; the advisory does not specify the affected version range. Check which roles have the access administration pages permission, as users with that permission can reach the module's entity add/edit dialogs for entity reference fields.

The advisory identifies the requirement for a role with the access administration pages permission as a mitigating factor.

This module renders entity add/edit forms inside an AJAX dialog for use with entity reference fields.

This module relies only on the "access administration pages" permission, without checking whether the current user had create or update access to the entity itself.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "access administration pages".