Salesforce Suite CVE-2026-13243

Exploitation requires a Drupal site running the Salesforce Suite module (version ≤5.1.3) and a victim who is currently authenticated to that site with the privileges needed for the targeted action; the attacker must induce that victim to load attacker-controlled content (malicious link, page, or embedded request) while their Drupal session is active. Although the published CVSS vector marks UI:N, the CWE-352 CSRF nature means victim interaction and an existing authenticated session are the practical prerequisites and the primary limiting factors - an attacker cannot exploit this against an anonymous or logged-out user, and impact is bounded by the victim's permission level. This limiting condition is why real-world risk is narrower than the 9.8 score implies.

The signals conflict and should be weighed carefully rather than taken at the 9.8 face value. The NVD/vendor CVSS vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) yields 9.8 Critical, but UI:N is inconsistent with the CWE-352 CSRF classification - CSRF inherently requires a victim to trigger the forged request, which normally maps to UI:R and lowers the score. This suggests the published vector may overstate exploitability. Countervailing signals reinforce lower real-world urgency: EPSS is only 0.10% (1st percentile), there is no CISA KEV listing, and no public exploit code is identified. There is no SSVC decision data provided. Net assessment: treat this as a genuine issue worth patching on a normal contrib-security cadence, but the Critical rating likely reflects the automated CVSS worst-case rather than confirmed unauthenticated network RCE-equivalent risk; verify the interaction and impact assumptions against SA-CONTRIB-2026-063.

An attacker crafts a malicious web page or email containing an auto-submitting form or embedded request targeting a state-changing endpoint of the Salesforce Suite module. When an authenticated Drupal user with the relevant permissions visits the page while logged in, their browser silently sends the forged request, causing the module to perform an unwanted action (e.g., altering Salesforce integration configuration or mappings) under the victim's identity. No public exploit code is currently identified, and success depends on the victim being authenticated and interacting with attacker content.