Automated Logout EUVD-2026-16393

While a CVSS score is not provided, the underlying CSRF vulnerability in logout functionality represents a moderate risk in most Drupal deployments. The attack vector is network-based and requires no privileges, but depends on user interaction (visiting a malicious link or page while authenticated). The technical impact is limited to session manipulation and potential denial of service via forced logout rather than data exfiltration or system compromise. CSRF vulnerabilities are generally considered automatable once crafted; however, the specific impact scope of this logout module is constrained. The Drupal security team has assigned this a contributed module advisory (SA-CONTRIB-2026-030), indicating it meets the vendor's security reporting threshold. Without KEV status or confirmed public exploit code, this represents a legitimate but not critical-priority vulnerability requiring patching as part of routine maintenance cycles rather than emergency response.

An attacker crafts a malicious webpage or sends a specially crafted link to a Drupal administrator who is currently logged into their Drupal site. When the administrator visits the attacker's page while authenticated, the page silently submits a request to the Drupal Automated Logout module endpoints (such as logout or settings modification) without the administrator's knowledge or consent. Because the module fails to validate CSRF tokens, the request succeeds, potentially forcing the user to be logged out or modifying logout settings. The attacker requires no special privileges and can conduct this attack remotely, though it does depend on the victim's browser maintaining a valid session cookie.