EUVD-2026-43067
GHSA-585m-5jj4-5474
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CSRF requires victim interaction (UI:R) so PR:N applies to the attacker but a logged-in victim is needed; impact is primarily unauthorized state change (I:H), with limited confidentiality and no direct availability effect.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
7DescriptionCVE.org
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Salesforce Suite allows Cross Site Request Forgery. This issue affects Salesforce Suite versions: from 0.0.0 to 5.1.3.
AnalysisAI
Cross-Site Request Forgery in the Drupal Salesforce Suite contrib module (all versions from 0.0.0 up to and including 5.1.3) lets an attacker forge state-changing requests that are executed with the privileges of an authenticated Drupal user who is tricked into loading attacker-controlled content. The Drupal security team (SA-CONTRIB-2026-063) rates it critical, and a fixed release is available; no public exploit code has been identified and EPSS is very low (0.10%, 1st percentile), indicating no observed exploitation activity. Note that the published CVSS vector (UI:N) is atypical for CSRF, which normally depends on victim interaction, so the real-world impact profile should be verified against the vendor advisory.
Technical ContextAI
The affected component is the Salesforce Suite, a Drupal contributed module (CPE cpe:2.3:a:drupal:salesforce_suite) that integrates Drupal sites with the Salesforce CRM platform for data mapping, synchronization, and push/pull operations. The root cause is CWE-352 (Cross-Site Request Forgery): one or more of the module's request handlers accept state-changing operations without validating an anti-CSRF token, so Drupal cannot distinguish a legitimate form submission from a forged one originating on a third-party page. Drupal's Form API normally supplies per-form CSRF tokens automatically; CSRF flaws in contrib modules typically arise where routes, menu callbacks, or AJAX endpoints perform mutating actions via GET or via forms/links that bypass or omit token validation.
RemediationAI
Patch available per vendor advisory: upgrade the Salesforce Suite module to the fixed release referenced in Drupal SA-CONTRIB-2026-063 (https://www.drupal.org/sa-contrib-2026-063) - the exact patched version is not stated in the provided data, so confirm it from the advisory rather than assuming (the fix is expected in the first release above 5.1.3). Until the update is applied, reduce exposure by limiting who holds the Drupal permissions the module's actions depend on and by restricting or gating access to the affected module routes/admin pages (for example via reverse-proxy access rules), accepting that this may inconvenience legitimate administrators; ensure standard Drupal CSRF and session protections are in force and advise privileged users to avoid browsing untrusted sites in the same session as the Drupal admin interface. Do not disable Drupal's Form API token handling. Cite and follow the vendor advisory for the authoritative fixed version.
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today