Server-Side Request Forgery in Drupal Entity Share Websub
CVE-2026-73474

5.3MEDIUM

Key Information:

Vendor

Drupal
Status
Entity Share Websub
Vendor
CVE Published:
2 September 2026

What is CVE-2026-73474?

A Server-Side Request Forgery (SSRF) vulnerability exists in the Drupal Entity Share Websub, which could allow remote attackers to manipulate server requests or access sensitive data by crafting specific requests. This security flaw is present in Entity Share Websub versions ranging from 0.0.0 to 1.1.2, potentially exposing affected systems to unauthorized information exposure and exploitation.

Affected Version(s)

Entity Share Websub 0.0.0 < 1.1.2

References

https://www.drupal.org/sa-contrib-2026-097

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Marcus Johansson (marcus_johansson)
Shawn Duncan (fathershawn)
Jeffrey S. Mattson (jeffreysmattson)
Swan Kalata (akalata)
Neil Drumm (drumm)
Greg Knaddison (greggles)
.