Drupal Screenshot CVE-2026-76759

Exploitation requires the attacker to hold high-privilege (administrator-level) authenticated access to the Drupal site - PR:H in the CVSS vector confirms this. The Screenshot contributed module must be installed and enabled; it is not part of Drupal core and is not present in default installations. A victim user with a lower privilege level must subsequently visit or be directed to the page rendering the injected screenshot content (UI:R). The high attack complexity (AC:H) suggests additional preconditions exist, possibly related to specific screenshot configuration, page context, or bypass of Drupal's built-in XSS filtering layers. Exploitation is limited to Drupal sites that have deliberately installed this contributed module, which is a niche deployment.

The CVSS base score is 7.3 with vector AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N. The high privilege requirement (PR:H) is a significant real-world limiter: the attacker must already hold administrative or highly elevated access to inject the XSS payload. Combined with the required user interaction (UI:R) from a victim and high attack complexity (AC:H), exploitation is substantially constrained relative to unauthenticated XSS. However, the scope change and C:H/I:H impact metrics reflect the downstream risk to lower-privileged users once the payload is in place - stored XSS from an admin context can persist and affect many victims. No EPSS data was provided; given the privilege bar, real-world mass exploitation risk is assessed as low-to-moderate. No KEV listing and no public exploit code further support treating this as a patching priority rather than an emergency response item. The affected version range is listed as wildcard (*.*), suggesting all published versions are vulnerable until a fix is applied.

An attacker who has obtained administrator-level access to a Drupal site (via credential theft, privilege escalation, or insider access) injects a malicious JavaScript payload through the Screenshot module's input surface. When an ordinary authenticated user navigates to the page rendering the screenshot output, the payload executes in their browser, stealing their session cookie or Drupal CSRF token, which the attacker then uses to perform actions on the site as the victim.