EUVD-2026-113582
GHSA-h245-vm7g-29gx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with high-privilege Drupal account
-
ExploitReach vulnerable ECA Helper function
-
ExecutionTrigger flawed handling
-
ImpactDisclose protected information
Vulnerability Assessment
| Exploitation Conditions | Exploitation requires an authenticated attacker holding high-level privileges on the target Drupal installation (CVSS PR:H), with the ECA Helper contrib module installed and enabled. The specific feature, configuration, or request that triggers the flaw is not described in the available sources. Limiting factors that reduce real-world risk: the required privileged account, high attack complexity (AC:H) implying conditions outside the attacker's full control, and the module's niche deployment footprint. No user interaction is required (UI:N). |
| Impact | This is a moderate-severity issue (CVSS 5.9) that does not warrant emergency prioritization. The CVSS vector CVSS:3.1/AV:N/AC:H/PR:H/UI:N shows network reach but two meaningful brakes: high attack complexity (AC:H) and high privileges required (PR:H), meaning an attacker must already hold a privileged, authenticated Drupal account. The exploitation signals reinforce low real-world urgency: EPSS is 0.14% (3rd percentile), there is no CISA KEV listing, and no public exploit was identified at time of analysis. The vuln.today decision label is 'this_month' (not act_now/emergency), which is consistent with a patch-on-normal-cycle posture. Note one data tension to verify: the 'Information Disclosure' tag and the near-empty description imply a confidentiality-oriented flaw, yet the supplied vector asserts I:H (integrity impact) - the described weakness class does not obviously support a full integrity compromise, so the integrity rating should be confirmed with the Drupal advisory. Affected versions are given only as '*.*', so the precise vulnerable range is not pinned down in the input. |
| Exploit ScenarioDerived | An attacker who already holds a high-privileged, authenticated account on a Drupal site running the ECA Helper module abuses the vulnerable functionality to read information they should not be able to access. The specific trigger is not described in the available sources, and no public exploit code was identified; high attack complexity suggests non-trivial, non-deterministic conditions must be met. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 30, 2026
Information disclosure in the Drupal ECA Helper contrib module affects all released versions (*.*), letting a remote attacker who already holds a high-privilege authenticated account on the Drupal site reach data that should not be exposed to them. The assessed severity is CVSS 5.9 (moderate) with high attack complexity (AC:H) and a privileged-account precondition (PR:H), and the impact is scoped to confidentiality only. The flaw is not in CISA KEV, EPSS is 0.14% (3rd percentile), no public exploit identified at time of analysis, and the priority decision is this_month rather than immediate action.
RemediationAI
The supplied data does not list an exact fixed version, so patch status should be confirmed against Drupal Security Advisory SA-contrib-2026-193 (https://www.drupal.org/sa-contrib-2026-193), which is the authoritative source for the corrected release of the ECA Helper module; no vendor-released patch with a specific version number is identified at time of analysis. Because exploitation requires an authenticated account holding high-level privileges (PR:H) plus high attack complexity, the practical exposure tracks to who can obtain such an account: review and tighten permissions that grant access to the ECA Helper module's functionality so that only trusted administrators hold them, noting the trade-off that site builders relying on ECA-driven workflows may lose configuration access. If the module is installed but not actively used, uninstalling or disabling it removes the attack surface entirely, at the cost of any dependent ECA models that reference it; if it is in use, keep the deployment on the vendor-patched release as soon as the advisory identifies it and monitor the Drupal advisory page for the fixed version.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in composer
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ECA Helper is a contributed companion module to Drupal's ECA (Event-Condition-Action) framework, which lets site builders model workflow logic by reacting to events and evaluating conditions; the module is identified in the intelligence feeds by the CPE string cpe:2.3:a:drupal:eca_helper:*:*:*:*:*:*:*:*, covering every version. No CWE is assigned in the supplied data, so the precise root-cause class is not documented, and the specific feature, configuration, or request that triggers the flaw is not described in the available sources. The disclosure is classified under the Information Disclosure tag and the authoritative assessment limits impact to confidentiality (C:H/I:N/A:N), even though the raw feed vector listed an integrity component; the assessed vector should be treated as the accurate impact scope. Exploitation is constrained by the requirement for an authenticated high-privilege account on the target installation together with the module being installed and enabled, and by high attack complexity implying conditions outside the attacker's full control, plus the niche deployment footprint of the module. No user interaction is required (UI:N).
Know when Eca Helper gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
Network-reachable but needs a high-privilege account (PR:H) and non-trivial conditions (AC:H); 'Information Disclosure' tag supports C:H with no integrity or availability impact.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in Drupal ECA Helper. This issue affects ECA Helper versions: *.*.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB