What is the CVSS score of CVE-2026-1554?

CVE-2026-1554 has a CVSS 3.1 base score of 4.2 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Central Authentication System Server are affected by CVE-2026-1554?

CVE-2026-1554 presents moderate security risk rated CVSS 4.2. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2026-1554?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Central Authentication System Server CVE-2026-1554

MEDIUM

XML Injection (aka Blind XPath Injection) (CWE-91)

2026-02-04 mlhess@drupal.org

Drupal Privilege Escalation Central Authentication System Server

4.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.2 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Feb 04, 2026 - 21:15 nvd

MEDIUM 4.2

DescriptionCVE.org

XML Injection (aka Blind XPath Injection) vulnerability in Drupal Central Authentication System (CAS) Server allows Privilege Escalation.This issue affects Central Authentication System (CAS) Server: from 0.0.0 before 2.0.3, from 2.1.0 before 2.1.2.

AnalysisAI

Central Authentication System Server versions up to 2.0.3 contains a security vulnerability (CVSS 4.2).

Technical ContextAI

affects Central Authentication System Server. XML Injection (aka Blind XPath Injection) vulnerability in Drupal Central Authentication System (CAS) Server allows Privilege Escalation.This issue affects Central Authentication System (CAS) Server: from 0.0.0 before 2.0.3, from 2.1.0 before 2.1.2.