Search API Autocomplete CVE-2026-16640

The target Drupal site must have the Search API Autocomplete contributed module installed and enabled at a version from 0.0.0 to less than 1.12.0. No authentication is required of the attacker (PR:N per CVSS vector). Exploitation is gated by mandatory victim interaction (UI:R): a real user must click or navigate to the attacker-crafted URL, requiring phishing or social engineering. This prerequisite prevents automated or worm-style mass exploitation. Exploitation is further limited to sites running this specific contributed module - Drupal core installations without the module are unaffected. The impact is constrained to low-level confidentiality and integrity effects (C:L/I:L) with no availability impact, meaning exploitation enables session theft or page manipulation but not server-side code execution or data destruction.

The CVSS 6.1 medium score accurately reflects a network-accessible (AV:N), low-complexity (AC:L) attack with no attacker authentication required (PR:N) but mandatory victim interaction (UI:R) - a prerequisite that substantially limits opportunistic mass exploitation. The EPSS score of 0.15% at the 4th percentile is notably low, indicating that the broader security community has not observed meaningful exploitation activity against this vulnerability, consistent with the absence of a CISA KEV listing or any known public proof-of-concept. Reflected XSS vulnerabilities of this class are well-understood and straightforward to exploit once the vulnerable parameter is identified, but the UI:R gate means purely automated exploitation is not feasible. The limited impact metrics (C:L/I:L/A:N) constrain real-world damage to session hijacking and authenticated action forgery scenarios rather than full system compromise. Overall, this represents a genuine but non-urgent vulnerability - even a mid-sized IT team with a broad Drupal estate should treat this as a normal patching priority rather than an emergency, scheduling the upgrade within standard maintenance cycles unless the affected site handles particularly sensitive authenticated sessions.

An attacker identifies the Drupal site's autocomplete search endpoint and crafts a URL embedding a JavaScript payload in the vulnerable query parameter. The attacker distributes this URL via phishing email or a deceptive link targeting authenticated users of the site. When a victim clicks the link, the server reflects the unsanitized input back in the autocomplete response, the script executes in the victim's browser, and the attacker harvests the victim's session cookie or performs authenticated actions on their behalf.