Disable Login Page CVE-2026-18260

Exploitation requires the attacker to hold high-privilege access within the Drupal instance equivalent to the Drupal administrator role (PR:H) - the vulnerability cannot be triggered by anonymous or standard authenticated users. The 'Disable Login Page' contrib module must be installed and enabled on the target site. High attack complexity (AC:H) indicates that beyond module presence, additional specific conditions must align - the precise nature is not detailed in available data, but CWE-20 patterns in redirect/configuration modules typically require a particular configuration state or input path to be reachable. User interaction (UI:R) from a site user is also required to complete exploitation, meaning the attacker cannot act entirely autonomously after gaining admin access. What limits exploitation: the three-factor prerequisite of administrative credentials, complex attack conditions, and required user interaction makes fully automated or unauthenticated abuse impossible; sites that enforce strict administrator role assignment and monitor administrative configuration activity face minimal realistic risk from external actors.

The CVSS 5.7 Medium score reflects a genuinely constrained threat profile: the vector AC:H (high attack complexity), PR:H (administrator-level privileges required), and UI:R (user interaction required) collectively eliminate automated, opportunistic, and unauthenticated exploitation vectors. This is not a case where a high CVSS base score is inflated by theoretical impact - the C:H and I:H metrics are meaningful, but the prerequisites are severe enough that only a malicious or compromised Drupal administrator acting under specific conditions could realistically exploit this. The EPSS score of 0.14% at the 4th percentile corroborates the very low observed exploitation probability. Absence from the CISA KEV catalog and lack of any identified POC further reduce urgency. The practical risk is most relevant to multi-tenant Drupal environments where administrator roles are granted to partially trusted users, or to sites where administrative credential compromise is a plausible threat scenario. The affected version range covers all released versions (*.* ), meaning no safe version exists until an advisory-confirmed patch is applied.

An attacker who has obtained or already holds Drupal administrator credentials on a site running the 'Disable Login Page' module crafts a malicious input - most likely a manipulated configuration parameter or redirect value - that bypasses the module's input validation. Under the specific complex conditions required (AC:H), the attacker induces a site user to interact with the manipulated configuration or a triggered redirect, causing the vulnerable code path to execute and resulting in unauthorized disclosure of sensitive site data or unauthorized modification of site content or configuration. No public proof-of-concept code has been identified, making ad hoc exploitation by unsophisticated actors unlikely.