URL Redirection Vulnerability in Drupal Core by Drupal
CVE-2026-55806

5.9MEDIUM

Key Information:

Vendor

Drupal
Status
Drupal Core
Vendor
CVE Published:
10 July 2026

What is CVE-2026-55806?

A URL Redirection vulnerability in Drupal core allows attackers to redirect users to untrusted sites, leading to potential content spoofing. This security issue impacts a range of Drupal core versions, compromising user trust and data integrity. Patch your installations promptly to mitigate risks and secure your web applications.

Affected Version(s)

Drupal core 0.0.0 < 10.5.12

Drupal core 10.6.0 < 10.6.11

Drupal core 11.2.0 < 11.2.14

References

https://www.drupal.org/sa-core-2026-007

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Melih Acikoz
Michael Winser (michaelwinser)
Willem Drupal enthousiast (willempje2)
Lee Rowlands (larowlan)
catch (catch)
cilefen (cilefen)
Greg Knaddison (greggles)
Lee Rowlands (larowlan)
Dave Long (longwave)
James Gilliland (neclimdul)
Juraj Nemec (poker10)
Jess (xjm)
.