Drupal Address Suggestion CVE-2026-81167

Exploitation requires an attacker to hold a highly privileged Drupal account (administrator or equivalent role with access to the Address Suggestion configuration or relevant content forms), satisfying the PR:H CVSS metric. Additionally, a separate victim user must load the page containing the injected payload (UI:R), meaning the attack is not self-contained. The Address Suggestion contributed module must be installed and enabled on the Drupal site. What limits exploitation: the high-privilege prerequisite rules out unauthenticated or low-privileged attackers; the attack is therefore primarily relevant to insider-threat or post-account-compromise scenarios rather than opportunistic network attacks.

The overall risk profile is moderate-to-low. The CVSS 4.8 Medium score is driven down primarily by PR:H (high privileges required) and UI:R (victim interaction required), both of which impose real-world friction on exploitation. An attacker must first compromise or obtain a Drupal administrator account before planting the XSS payload - a prerequisite that rules out opportunistic mass exploitation. EPSS data is absent from the provided intelligence, and the vulnerability carries no CISA KEV listing and no confirmed public exploit code, reinforcing a low active-exploitation signal. The S:C scope change does elevate the theoretical ceiling - a stored XSS planted by a rogue admin could target any authenticated user who visits the affected page - but C:L and I:L caps keep the per-victim impact limited to session token theft or minor DOM manipulation rather than full data exfiltration. In practical terms this is a low-priority issue for most organisations unless insider threat or compromised admin credentials are a material concern.

A malicious or compromised Drupal administrator navigates to the Address Suggestion module's configuration or content-editing form and injects a JavaScript payload into an address field that is stored and later rendered to site visitors. When a lower-privileged user or anonymous visitor loads the affected page, the script executes in their browser, potentially stealing session cookies or performing actions on their behalf. No public proof-of-concept code has been identified, so exploitation currently requires independent discovery of the vulnerable field.