Drupal Development Environment CVE-2026-15088

Exploitation requires three concurrent conditions. First, the target Drupal instance must have the Development Environment contributed module installed and enabled - this is not a Drupal core component and is not present by default. Second, the attacker must possess or have compromised a Drupal account with high-privilege permissions (PR:H), consistent with administrative or equivalent roles. Third, user interaction is required (UI:R), meaning a privileged user must perform an action - such as visiting a crafted URL or submitting a manipulated form - for the attack to succeed. Limiting factors include: the high access complexity (AC:H) reducing the reliability of exploitation; the PR:H requirement excluding unauthenticated or low-privileged attackers entirely; the UI:R requirement preventing fully automated, unassisted exploitation; and the module's intended scope as a development tool, making its presence in hardened production environments uncommon.

Despite C:H and I:H impact ratings, the composite real-world risk is substantially reduced by the stringent attack prerequisites encoded in the CVSS vector: AC:H (non-trivial exploitation complexity), PR:H (administrative privileges required), and UI:R (victim must take an action). The EPSS score of 0.14% at the 4th percentile corroborates this - exploitation has not been observed in the wild and automated scanning is highly unlikely. No KEV listing exists and no public proof-of-concept has been identified. This places the vulnerability firmly in the 'high CVSS impact but low exploitability' category. Patch status is unconfirmed from available data - the advisory URL (drupal.org/sa-contrib-2026-089) should be consulted for remediation specifics. The affected version range of *.* (all versions) is unusually broad and may reflect a module-wide architectural issue rather than a version-specific regression. In practice, because this module is oriented toward development environments rather than production deployments, the blast radius is likely further limited; organizations running it in production should treat that configuration itself as a risk factor regardless of this CVE.

An attacker who has already obtained Drupal administrative credentials - through phishing, credential reuse, or a prior compromise - navigates to a vulnerable input surface within the Development Environment module and submits a crafted payload that bypasses input validation. With victim interaction (such as an admin clicking a malicious link or visiting a crafted admin page), the attacker achieves unauthorized read and write access to sensitive data within the Drupal application's scope. No public proof-of-concept is known at time of analysis, meaning this scenario requires targeted effort rather than automated exploitation.