{"field_issue_status":"7","field_project":{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/3593957","id":"3593957","resource":"node","machine_name":"inline_entity_form_dialog"},"field_sa_advisory_id":"199","field_sa_coordinated_by":{"value":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022\/u\/akalata\u0022 rel=\u0022nofollow\u0022\u003ESwan Kalata (akalata)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/poker10\u0022 rel=\u0022nofollow\u0022\u003EJuraj Nemec (poker10)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003C\/ul\u003E","format":"1"},"field_sa_criticality":"AC:Basic\/A:User\/CI:Some\/II:Some\/E:Theoretical\/TD:All","field_sa_description":{"value":"\u003Cp\u003EThis module renders entity add\/edit forms inside an AJAX dialog for use with entity reference fields.\u003C\/p\u003E\n\u003Cp\u003EThis module relies only on the \u0022access administration pages\u0022 permission, without checking whether the current user had create or update access to the entity itself. \u003C\/p\u003E\n\u003Cp\u003EThis vulnerability is mitigated by the fact that an attacker must have a role with the permission \u0022access administration pages\u0022.\u003C\/p\u003E","format":"1"},"field_sa_fixed_by":{"value":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022\/u\/marcus_johansson\u0022 rel=\u0022nofollow\u0022\u003EMarcus Johansson (marcus_johansson)\u003C\/a\u003E\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/zeeshan_khan\u0022 rel=\u0022nofollow\u0022\u003EZeeshaan khann (zeeshan_khan)\u003C\/a\u003E\n\u003C\/li\u003E\u003C\/ul\u003E","format":"1"},"field_sa_reported_by":{"value":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022\/u\/marcus_johansson\u0022 rel=\u0022nofollow\u0022\u003EMarcus Johansson (marcus_johansson)\u003C\/a\u003E\n\u003C\/li\u003E\u003C\/ul\u003E","format":"1"},"field_sa_solution":{"value":"\u003Cp\u003EInstall the latest version:\u003C\/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EIf you use the Inline Entity Form Dialog module for Drupal 11, upgrade to \u003Ca href=\u0022\/project\/inline_entity_form_dialog\/releases\/1.0.6\u0022 rel=\u0022nofollow\u0022\u003EInline Entity Form Dialog 1.0.6\u003C\/a\u003E\u003C\/li\u003E\n\u003C\/ul\u003E","format":"1"},"field_sa_type":"Access bypass","field_issue_last_status_change":"1791390177","field_sa_cve":["CVE-2026-107258"],"field_is_psa":"0","field_affected_versions":"\u003C1.0.6","field_fixed_in":[{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/3629146","id":"3629146","resource":"node"}],"nid":"3620258","vid":"14514956","is_new":false,"type":"sa","title":"Inline Entity Form Dialog - Moderately critical - Access bypass - SA-CONTRIB-2026-199","language":"en","url":"https:\/\/www.drupal.org\/sa-contrib-2026-199","edit_url":"https:\/\/www.drupal.org\/node\/3620258\/edit","status":"1","promote":"0","sticky":"0","created":"1791390177","changed":"1791390177","author":{"uri":"https:\/\/www.drupal.org\/api-d7\/user\/406161","id":"406161","resource":"user"},"comment":"0","comments":[{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16784745","id":16784745,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16784746","id":16784746,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16792150","id":16792150,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16797954","id":16797954,"resource":"comment"}],"comment_count":0,"comment_count_new":false,"body":[],"feeds_item_guid":null,"feeds_item_url":null,"feed_nid":null,"flag_flag_tracker_follow_user":[],"flag_tracker_follower_count":null,"has_new_content":null,"last_comment_timestamp":"1791390177","sa_risk":[14,"Moderately critical"],"sa_id":"SA-CONTRIB-2026-199"}