Drupal Entity Browser CVE-2026-18986

Exploitation requires that the attacker holds high-privilege access to the Drupal administrative interface - specifically, permission to configure Entity Browser widgets or create content through Entity Browser-enabled workflows. This is an authenticated attack (PR:H); unauthenticated or low-privileged users cannot store the XSS payload. A victim must subsequently load a page that renders the poisoned Entity Browser output (UI:R). Limiting factors include the PR:H authentication gate, the non-default complexity of Drupal role assignment, and the requirement for a separate victim browsing action. Default Drupal installations restrict administrative access appropriately, so exposure is primarily a risk on sites where content-editor roles have been granted Entity Browser configuration permissions.

The CVSS base score of 4.8 accurately reflects the constrained real-world risk profile. PR:H means exploitation is gated behind high-privilege access - the attacker must already hold elevated Drupal permissions (typically an administrator or similarly privileged role) to store a malicious payload through Entity Browser configuration or content workflows. UI:R further limits opportunistic exploitation, requiring a victim to load the affected page. SSVC signals reinforce this: exploitation is assessed as 'none', the attack is not automatable, and technical impact is only partial. Even a mid-sized municipal IT team in bytom running a Drupal-based intranet would face meaningful barriers to exploitation given the PR:H requirement. EPSS data is not available in the provided intelligence, and the CVE is not listed in CISA KEV, so this should be treated as a lower-priority remediation item - important to patch but not requiring emergency response unless the Drupal instance is administered by partially trusted or unknown parties.

An attacker with Drupal administrator credentials navigates to the Entity Browser widget configuration and injects a malicious JavaScript payload into a field that is rendered without output encoding. When any site user - including editors or anonymous visitors - loads a page that renders the affected Entity Browser output, the script executes in their browser, enabling the attacker to steal session cookies or perform actions on behalf of the victim. No public proof-of-concept exploit code has been identified at the time of analysis.