Drupal Core CVE-2026-55806

Exploitation requires that the target Drupal site is running an affected version and that the victim user visits a specifically crafted URL - making this attack social-engineering-dependent. Based on the CVSS PR:N metric, no authentication is required to trigger the redirect; however, the attack does not succeed without a victim following the link (user interaction is required, despite UI:N in the provided vector - this is a further inconsistency to verify with the vendor). No non-default configuration is necessary: the flaw exists in default Drupal Core installations across all affected version lines. Limiting factors include: victim must be induced to click the crafted URL; direct impact is confined to spoofing and phishing rather than code execution or privilege escalation; deployments enforcing strict allowlist-based redirect validation at a WAF or reverse proxy layer may not be exploitable even without patching.

The CVSS vector supplied (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, reported score 5.9) contains two material inconsistencies that should be confirmed with the vendor before using it for prioritization decisions: first, the mathematical score for that vector computes to approximately 4.4-5.2, not 5.9; second, Availability:High with no Confidentiality or Integrity impact is semantically anomalous for CWE-601 - open redirect primitively affects Integrity (spoofed content delivery) and Confidentiality (credential harvesting) rather than Availability. This suggests a possible scoring error. At face value, real-world risk is moderate: EPSS at 0.13% reflects that automated exploitation is not occurring at scale, and the absence from CISA KEV confirms no confirmed active exploitation at time of analysis. The wide affected version range (spanning 10.x and all 11.x branches including fully unsupported 11.0.* and 11.1.*) broadens exposure, but the social-engineering dependency and limited direct system impact constrain actual attacker leverage.

An attacker identifies a Drupal endpoint that accepts an unvalidated redirect destination parameter and crafts a URL on the legitimate site's domain - such as a login or password-reset page - that points the redirect to a credential-harvesting page mimicking the victim organization. The link is delivered via targeted phishing email; the victim trusts the URL because it resolves to a known domain before silently forwarding them to the attacker's site. No public exploit code has been identified at time of analysis, but open redirect exploitation is well understood, low-skill, and widely scripted.