Theme Negotiation By Rules EUVD-2026-15467

While a CVSS score is not publicly available for this CVE, the vulnerability's nature as a CSRF flaw in an administrative/configuration module suggests moderate-to-high real-world risk. CSRF vulnerabilities typically have a network attack vector (AV:N) with low attack complexity (AC:L) and no privilege requirement if targeting end users, making exploitation straightforward. The fact that this is a Drupal contrib module (not core) reduces the blast radius compared to core vulnerabilities, but any site using Theme Negotiation by Rules is exposed. The Drupal security advisory (SA-contrib-2026-012) indicates this has received formal vendor attention. Without EPSS data, CVSS vector details, or public POC information available, the risk should be assessed as moderate-to-high for affected installations: CSRF vulnerabilities are generally automatable and can be weaponized at scale via malicious sites or compromised content. This warrants prompt patching within 30 days of awareness.

An attacker crafts a malicious HTML page or injects code into a compromised website that, when visited by an authenticated Drupal administrator, silently submits a request to change the site's active theme or theme rules without the administrator's knowledge or consent. Because the Theme Negotiation by Rules module fails to validate CSRF tokens, the request succeeds, altering the site's appearance or behavior. This could be chained with stored XSS or other attacks to deface the site or inject malicious content. No public POC is indicated in the available intelligence, but the attack requires only that an admin visit a malicious link, making it a credible threat in forums, emails, or social engineering campaigns targeting site maintainers.