Advanced Content Feedback CVE-2026-13232

Exploitation requires an authenticated Drupal session with at least low-level privilege (PR:L per CVSS), meaning the attacker must hold a valid user account on the target site - unauthenticated visitors cannot exploit this flaw. The Advanced Content Feedback (admin_feedback) module must be installed and enabled on the Drupal site. High attack complexity (AC:H) further constrains exploitation: the attacker must have non-trivial knowledge of the module's internal URL structure or administrative paths to perform effective forceful browsing. The vulnerability does not involve any user interaction from a privileged party. Impact is limited to integrity only (I:L), meaning confidentiality of data and site availability are not directly threatened. The requirement for an existing authenticated session and high complexity are the primary limiting factors against broad or automated exploitation.

The CVSS 3.1 base score of 3.1 (Low) reflects a constrained risk profile: network-reachable (AV:N) but requiring existing authentication (PR:L) and elevated attack complexity (AC:H), with only a limited integrity impact (I:L) and no confidentiality or availability consequence. EPSS at 0.14% (4th percentile) signals that exploitation is extremely unlikely in the near term relative to the broader CVE population. SSVC independently corroborates this - exploitation status is none, the attack is not automatable, and technical impact is only partial. There is no CISA KEV listing and no public POC. The high attack complexity suggests that exploitation requires non-trivial knowledge of exact internal path structures or specific module configuration conditions. In aggregate, this is a low-priority finding: real-world risk is well below what the network-vector classification alone might imply, and organizations running the module in default configurations with standard role structures face minimal exposure.

An attacker with a valid low-privilege Drupal account (such as an authenticated editor or contributor) crafts direct HTTP requests to administrative content-feedback endpoints that are intended to be restricted to site administrators, exploiting the missing or incorrect authorization check. By enumerating or guessing module-specific URL paths, the attacker can read or potentially modify content feedback records beyond their assigned role. No public POC exists at time of analysis, meaning successful exploitation currently requires manual knowledge of the module's internal routing structure.