Drupal Orejime CVE-2026-6095

User interaction is required - the victim must follow a crafted link or visit a page where the malicious payload is rendered (UI:R per CVSS vector). No authentication is required from the attacker's side (PR:N). The Orejime module must be installed and active on the target Drupal site, which is a non-default configuration since Orejime is a contributed (not core) module. Exploitation is limited to Drupal sites running Orejime versions 0.0.0 through 2.0.15. The changed scope (S:C) means impact extends beyond just the page with the injection point, but the CVSS C:L/I:L bounds the per-exploitation impact to partial confidentiality and integrity loss rather than full compromise.

The CVSS base score of 6.1 (Medium) is directionally appropriate but requires contextual interpretation. The vector confirms network-exploitable, low-complexity, no-privilege-required access with user interaction needed - meaning an attacker must induce a victim to load a crafted URL or interact with a malicious page. The changed scope elevates the impact beyond a simple reflected XSS. Against these signals, the EPSS of 0.03% (8th percentile) indicates very low observed exploitation probability in the wild, KEV status is not listed (no confirmed active exploitation), and no public POC is known. The realistic priority is moderate for Drupal sites handling authenticated user sessions or sensitive data via cookie-consent flows: XSS with S:C can enable session theft, credential harvesting via injected forms, or defacement. For sites where the Orejime banner is visible to unauthenticated visitors, the attack surface is broad but the impact per the CVSS (C:L/I:L) is constrained. No conflicting signals between CVSS vector and description are apparent.

An attacker crafts a URL or link containing a malicious JavaScript payload targeting an Orejime input parameter - such as a cookie name, preference value, or banner configuration reflected in the page. When a site visitor clicks the link or visits the crafted page, the injected script executes in their browser within the scope of the target Drupal site, potentially exfiltrating session cookies or performing actions on behalf of the victim. No public POC is known, but the attack complexity is low per CVSS (AC:L), meaning exploitation requires no special conditions beyond delivering the link to a victim.