Entity Share Websub CVE-2026-73474

The Drupal installation must have the Entity Share Websub contributed module installed and enabled in a version from 0.0.0 through < 1.1.2. No authentication is required (PR:N) and no user interaction is needed (UI:N), making exploitation straightforward for any network-reachable attacker. The practical impact is highest in cloud environments where instance metadata services are reachable from the application layer and in environments lacking egress filtering. Impact is limited to partial confidentiality disclosure (C:L) - no write or denial-of-service capability is conferred. Sites that have never installed this contributed module are entirely unaffected, as this is not a Drupal core vulnerability.

The CVSS 5.3 Medium rating reflects an unauthenticated, network-reachable flaw with low complexity and limited confidentiality impact (C:L), with no integrity or availability consequences and an unchanged scope. SSRF vulnerabilities in Drupal modules are generally low-noise in isolation, but real-world impact scales sharply upward in cloud-hosted deployments where instance metadata services (e.g., AWS 169.254.169.254) are accessible - even a mid-sized municipal IT team in swidnica running Drupal on a cloud VPS with this module enabled should treat the patch as a routine but time-sensitive update rather than a deferred item. No EPSS data was provided, and this CVE is not listed in CISA KEV, indicating no confirmed active exploitation. No public POC has been identified. Risk is further constrained by the niche nature of the Entity Share Websub module, which limits the population of exposed instances.

An unauthenticated attacker crafts a WebSub subscription or notification request to the Drupal site, embedding a URL pointing to an internal service such as a cloud instance metadata endpoint. The Drupal server issues an outbound HTTP request to the attacker-specified target and the response - potentially containing cloud credentials, internal hostnames, or service data - is accessible to the attacker through timing or error-channel leakage. No public proof-of-concept has been identified at time of analysis.