Cross-Site Request Forgery Vulnerability in Drupal Project Browser
CVE-2026-96374

Currently unrated

Key Information:

Vendor

Drupal
Status
Project Browser
Vendor
CVE Published:
22 October 2026

What is CVE-2026-96374?

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Drupal Project Browser that could potentially allow an attacker to perform unauthorized actions on behalf of authenticated users. This weakness impacts various versions of the Project Browser, necessitating timely updates and patches to safeguard against exploitation and ensure the integrity of user interactions. Users are encouraged to review their current installations and apply security measures as outlined in the official Drupal advisories.

Affected Version(s)

Project Browser 0.0.0 < 2.0.3

Project Browser 2.1.0 < 2.1.5

References

https://www.drupal.org/sa-contrib-2026-178

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tin Nguyen Huu (s4m0y3d)
Chris Wells (chrisfromredfin)
Tin Nguyen Huu (s4m0y3d)
Swan Kalata (akalata)
Bram Driesen (bramdriesen)
Greg Knaddison (greggles)
Drew Webber (mcdruid)
Jess (xjm)
.