What is the CVSS score of CVE-2026-11914?

CVE-2026-11914 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Drupal Composer CVE-2026-11914

EUVD-2026-43092 MEDIUM

Improper Input Validation (CWE-20)

2026-07-10 drupal

GHSA-qfp7-j94c-gx97

Information Disclosure Drupal Composer

5.9

CVSS 3.1 · Vendor: drupal

Severity by source

Vendor (drupal) PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

5.9 MEDIUM

Network-reachable admin interface (AV:N), high privileges required for access (PR:H), and specific exploitation conditions (AC:H); no availability impact identified.

3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (drupal).

CVSS VectorVendor: drupal

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 18:06 vuln.today

CVE Published

Jul 10, 2026 - 21:59 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

vulnerability in Drupal Composer allows . This issue affects Composer versions: *.*.

AnalysisAI

Improper input validation in the Drupal Composer contributed module (SA-contrib-2026-046) exposes sites to confidentiality and integrity compromise when exploited by a highly privileged attacker over the network under specific conditions. The vulnerability, classified as CWE-20, affects all tracked versions of the module and carries a CVSS 3.1 score of 5.9 (Medium), with both high confidentiality and high integrity impact despite no availability impact. No public exploit code exists and no active exploitation has been identified; EPSS stands at 0.15% (5th percentile), and CISA has not added this to KEV.

Technical ContextAI

The affected component is the Drupal Composer contributed module (CPE: cpe:2.3:a:drupal:composer:*:*:*:*:*:*:*:*), a Drupal-ecosystem addon that bridges the Drupal CMS administrative interface with PHP Composer dependency management. It is distinct from the standalone PHP Composer tool itself. The root cause is CWE-20 (Improper Input Validation), meaning the module fails to adequately sanitize or validate input data in one or more code paths accessible to highly privileged authenticated users, leading to potential information disclosure (confirmed by the 'Information Disclosure' tag) and integrity manipulation (reflected in CVSS I:H). The high attack complexity (AC:H) suggests a non-trivial exploitation path that may require specific configuration states, race conditions, or crafted request sequences.

RemediationAI

The primary remediation path is to consult and apply guidance from the Drupal security advisory SA-contrib-2026-046 at https://www.drupal.org/sa-contrib-2026-046, which is the vendor's authoritative source for patch status and upgrade instructions. No specific patched version number is confirmed in the currently available intelligence data - the advisory should be checked directly for an exact fixed release. As a compensating control pending a patch, administrators should restrict access to the Drupal Composer module's administrative functionality to the minimum number of trusted accounts, leveraging Drupal's role-based access control to limit the pool of users who hold the high-privilege level required for exploitation. Disabling or uninstalling the Drupal Composer module entirely is a viable temporary mitigation if Composer management through the admin UI is not operationally required, with the trade-off that any Composer-driven dependency management workflows will need to move to the command line.