Privilege Escalation in SAML SSO - Service Provider by Drupal
CVE-2026-5343

7.4HIGH

Key Information:

Vendor

Drupal
Status
Saml Sso - Service Provider
Vendor
CVE Published:
28 May 2026

What is CVE-2026-5343?

A privilege escalation vulnerability exists in the SAML SSO - Service Provider for Drupal, allowing attackers to gain higher-level access than intended. The issue arises from an improper check for unusual or exceptional conditions, permitting unauthorized users to elevate their privileges. This affects all versions from 0.0.0 up to 3.1.3, highlighting the importance of performing updates and security audits to mitigate risks.

Affected Version(s)

SAML SSO - Service Provider 0.0.0 < 3.1.4

References

https://www.drupal.org/sa-contrib-2026-031

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tim de Jong | Freelance Drupal Developer (tim_dj)
Sudhanshu Dhage (sudhanshu0542)
Damien McKenna (damienmckenna)
Greg Knaddison (greggles)
Juraj Nemec (poker10)
Jess (xjm)
.