Drupal Project Browser CVE-2026-96374

Exploitation requires a victim who is already authenticated to a Drupal site running the affected Project Browser module (versions 0.0.0-2.0.2 or 2.1.0-2.1.4) to be lured into interacting with attacker-controlled web content while that session is active; this user-interaction requirement (UI:R) and the high attack complexity (AC:H) are the primary limiting factors. The attacker needs no credentials or privileges of their own (PR:N) because the forged request abuses the victim's existing session and the module's missing or inadequate CSRF token validation. The specific Project Browser operation that lacks anti-CSRF protection is not described in the available sources (Drupal advisory reference and NVD link), so the exact forgeable action cannot be stated with certainty. The complete fix is updating to Project Browser 2.0.3 (for the 0.x-2.0.x branch) or 2.1.5 (for the 2.1.x branch) as published by the vendor.

This is a genuinely low-to-moderate priority issue, not a high-severity emergency. The CVSS 3.1 base score is 4.2 (Medium) with vector AV:N/AC:H/PR:N/UI:R, meaning that although the flaw is network-reachable and needs no attacker privileges, successful exploitation depends on high attack complexity AND on tricking an authenticated Drupal user into interacting with attacker-controlled content - classic CSRF constraints. The supporting signals reinforce low urgency rather than contradict it: EPSS is 0.10% (1st percentile), the CVE is NOT on CISA KEV, and no public exploit or PoC reference is present in the input. The vuln.today decision label is 'this_month', consistent with a patch-on-normal-cycle item rather than act_now/emergency. Impact is bounded (C:L/I:L/A:N) - limited confidentiality and integrity effects, no availability impact. There is no conflict between the signals here: a medium CVSS, negligible EPSS, no KEV and no PoC all point the same direction. The main residual uncertainty is mechanistic - the available sources (a Drupal security advisory reference and an NVD link) do not describe exactly which Project Browser action lacks CSRF protection, so the precise state-changing operation an attacker could forge is not confirmed from the provided data.

An attacker crafts a malicious web page or email that, when opened by a Drupal administrator or privileged user who is currently logged into the target site, silently submits a forged state-changing request to the Project Browser module. Because the request rides on the victim's existing authenticated session, the module performs the action as if the user intended it. No public exploit code or PoC reference is present in the input, and the high attack complexity plus required user interaction make opportunistic mass exploitation unlikely.