Drupal Powerful Surveys CVE-2026-18261

Exploitation requires an authenticated Drupal user with high-level privileges (PR:H per CVSS vector), consistent with administrator or similarly elevated role access to the Powerful Surveys module. Additionally, user interaction is mandatory (UI:R), meaning the privileged user must actively perform a specific action - such as submitting a crafted form or following a manipulated link - making passive or background exploitation impossible. Attack complexity is rated High (AC:H), indicating additional race conditions or specific preconditions exist beyond simple network access. The vulnerability is network-reachable (AV:N), meaning the Drupal instance must be accessible over the network and the Powerful Surveys module must be installed and enabled. Exploitation is limited to these combined conditions: no special non-default configuration beyond module installation is specified, but the compound requirements of high privilege, active user interaction, and high complexity collectively constrain exploitation to deliberate, targeted scenarios.

The CVSS score of 5.7 (Medium) accurately reflects the compounding mitigating factors in the vector: AC:H, PR:H, and UI:R together substantially raise the exploitation bar despite C:H and I:H impact ratings. EPSS at 0.14% (4th percentile) aligns with this - no widespread exploitation is observed or anticipated in the current threat landscape. The vulnerability is absent from the CISA KEV catalog and no public POC has been identified, confirming no documented active exploitation. The information disclosure tag is the most operationally significant signal for defenders: deployments handling sensitive survey responses (HR, healthcare, compliance) face a higher data-risk consequence even within these constrained conditions. The PR:H requirement limits attack surface to administrator-level accounts, and UI:R implies a targeted social-engineering or CSRF-assisted approach rather than opportunistic automated scanning. This is a real but low-priority issue for most organizations - highest concern for Drupal sites processing sensitive survey data with externally reachable admin panels.

An attacker targeting a specific Drupal administrator social-engineers or tricks that user (UI:R) into submitting a crafted survey form payload or visiting a manipulated URL while authenticated with high privileges (PR:H). The Powerful Surveys module's input validation logic fails to reject the malformed input, allowing the attacker to either extract sensitive survey response data (information disclosure, consistent with the C:H rating) or manipulate survey records (I:H). No public exploit code currently exists to automate or simplify this scenario.