Drupal Screenshot CVE-2026-76782

Exploitation requires an authenticated session with high administrative privileges on the target Drupal installation (PR:H), ruling out unauthenticated remote attackers. AC:H indicates that specific conditions beyond a basic network request must be satisfied - likely a particular module configuration state or non-default Drupal permission assignment. User interaction is mandatory (UI:R): a second user must load the page or view the content containing the injected payload for the XSS to execute. Exploitation is therefore limited to insiders, compromised admin accounts, or social engineering scenarios where an admin can be induced to trigger the vulnerable rendering path. No special network position is required beyond reaching the Drupal site over the network.

The CVSS 3.1 vector AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N yields a base score of 7.3, which accurately reflects the tension between high theoretical post-exploitation impact and substantially constrained exploitability. PR:H restricts the attacker population to users holding administrative-level Drupal credentials, and AC:H signals that specific conditions beyond a simple network request must be met. UI:R requires a victim to load the poisoned content, adding another dependency. The scope-changed C:H/I:H outcome - session hijacking or full account takeover of affected users - is serious if achieved, and even a mid-sized municipal IT team in gliwice should treat this as a priority patch item during their next maintenance window rather than a crisis response. No EPSS score is available in the provided data, and the absence of KEV listing and public exploit code suggests exploitation remains opportunistic or theoretical at this time.

An attacker who holds or has compromised an administrative Drupal account navigates to the Screenshot module's configuration or input interface and submits a payload containing malicious JavaScript. When a target user - including another administrator - subsequently views the page or output that renders the screenshot data, the script executes in their browser, enabling the attacker to steal session cookies or perform actions on the target's behalf. No public exploit code has been identified at time of analysis.