Cross-Site Request Forgery Vulnerability in Drupal Project Browser
CVE-2026-96374

4.2MEDIUM

Key Information:

Vendor

Drupal
Status
Project Browser
Vendor
CVE Published:
22 October 2026

What is CVE-2026-96374?

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Drupal Project Browser that could potentially allow an attacker to perform unauthorized actions on behalf of authenticated users. This weakness impacts various versions of the Project Browser, necessitating timely updates and patches to safeguard against exploitation and ensure the integrity of user interactions. Users are encouraged to review their current installations and apply security measures as outlined in the official Drupal advisories.

Affected Version(s)

Project Browser 0.0.0 < 2.0.3

Project Browser 2.1.0 < 2.1.5

References

https://www.drupal.org/sa-contrib-2026-178

CVSS V3.1

Score:
4.2
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tin Nguyen Huu (s4m0y3d)
Chris Wells (chrisfromredfin)
Tin Nguyen Huu (s4m0y3d)
Swan Kalata (akalata)
Bram Driesen (bramdriesen)
Greg Knaddison (greggles)
Drew Webber (mcdruid)
Jess (xjm)
.