Drupal’s Separate Patch
Drupal’s Entity List module needs an update separate from core. The 14 October advisory for CVE-2026-108099 names 3.0.10 as the fix; earlier versions are affected.
The code-execution flaw is not directly exploitable alone. Serious paths involve other contributed modules, including an unauthenticated route; custom code may expose it too. Drupal’s critical 19/25 rating is not CVSS; exploitation is theoretical, not confirmed attacks. It supplies no exploit code, indicators, partner-module names or exposure count.
Two different maintenance decisions
The project page identifies the package as drupal/entity_list, with compatibility for Drupal ^10.1 or ^11. It builds entity lists without Views, using query, display and filter plugins.
Do not confuse it with Field UI in core, covered in BlackTree’s earlier report. Those branch targets are not this module’s.
For an agency maintaining inherited client sites, the practical problem is ownership. One team may maintain the central core build while another controls a customer’s contributed packages. Ask both for the deployed state before closing the work. A current central template cannot answer for a site last handed over by a departed supplier.
Make the result visible
Our recommendation is to reconcile each site’s dependency records with its running application. Keep the reviewed package and lock-file changes together through testing and deployment, rather than resolving a different dependency set on the live host. Record the owner of any exception.
Test representative content, user, file, media or taxonomy lists, including language selection, filters, sorting and paging. Check the visitor-facing result without an administrative session. Include custom query, display and filter routes rather than relying solely on a generic status page.
A version check and a functional check answer different questions: whether the repair arrived, and whether the service still works. Keep the evidence against each site.
Patching is not a retrospective verdict
If there are unexplained changes or suspicious requests, preserve the available application and deployment evidence and investigate them separately. A working updated service does not establish what happened before maintenance.
These are our recommendations, not results from inspecting readers’ sites.
