Improper Authorization in Drupal Entity Reference Manager (Merge entities) Enables Unauthorized Entity Deletion

Incorrect Authorization vulnerability in Drupal Entity Reference Manager (Merge entities) allows Forceful Browsing. This issue affects Entity Reference Manager (Merge entities) versions: from 0.0.0 to 1.0.3.

• Drupal Entity Reference Manager (Merge entities), project machine name entity_reference_manager, is identified as affected.
• The normalized record defines the affected range from 0.0.0 with lessThan 1.0.3; the Drupal advisory also states that versions <1.0.3 are affected.
• The advisory confirms a fix in Entity Reference Manager 1.0.3.
• No separate parallel release branch or status for other branches is established by the available evidence.

Entity Reference Manager (Merge entities) is an advanced Drupal administration module for identifying, analyzing, and replacing entity references. The flaw is a CWE-863 Incorrect Authorization issue: the module does not sufficiently restrict access to entity management operations. The advisory states that users who can view content can reach the entity merge functionality and delete arbitrary nodes, taxonomy terms, or media entities. The specific attacker-controlled input, route, parameters, and request format are not described in the available evidence. The confirmed scope is entity-management activity on the Drupal site; the available evidence does not establish code execution or data exposure.

The issue is reached through the Drupal application surface that exposes the module's entity-management functionality. The advisory characterizes attack complexity as basic and user interaction as none. The stated access condition is the ability to view content; whether an anonymous user can satisfy that condition depends on the site's configuration and is not established. A public exploit, active exploitation, or named campaign is not established by the available evidence.

The flaw breaks the intended privilege boundary between viewing content and performing entity-management or deletion operations. The confirmed technical outcome is unauthorized access to entity merging and arbitrary deletion of nodes, taxonomy terms, or media entities. Realistic consequences include loss of content integrity and availability, followed by restoration work or review of change history. The available evidence does not show that the flaw enables code execution, credential disclosure, or full server compromise.

The confirmed direct consequence is that a user able to view content may perform entity merging and delete nodes, taxonomy terms, or media entities outside the intended authorization boundary. This can cause content-integrity loss, publishing disruption, and recovery or change-review costs. Sites that rely on these entities for important publishing or operational workflows may experience greater disruption if unauthorized deletions are widespread. The available evidence does not confirm data disclosure, server compromise, or credential exposure.

1. Upgrade Entity Reference Manager (Merge entities) to exactly 1.0.3, the release identified by the Drupal advisory as fixing the issue.
2. After upgrading, check deployment inventories and lockfiles to ensure that no affected version remains deployed.
3. Review roles that can view content and manage entities, especially on sites containing important node, taxonomy, or media data.
4. If an immediate upgrade is not possible, treat sites running an affected version as exposed and temporarily restrict access to relevant entity-management functionality as an operational precaution. This is not a vendor-confirmed mitigation and does not replace the upgrade.

1. Inventory Drupal sites with the entity_reference_manager module enabled and record the exact deployed version from Composer or deployment metadata.
2. Identify instances within the affected version range and review the roles that can view content.
3. In a controlled test environment, verify that a role limited to viewing content cannot reach entity-merge or entity-deletion operations.
4. Review audit records, Drupal logs, and content history for unexpected merge or deletion activity involving nodes, taxonomy terms, or media entities. Treat this as precautionary monitoring, not as a vendor-confirmed indicator.
5. Do not treat the absence of suspicious log entries as proof of safety because the available evidence does not define specific log events or indicators.