Advanced Content Feedback EUVD-2026-43055

The Drupal Advanced Content Feedback (admin_feedback) contributed module must be installed and enabled on the target Drupal site, running any release from 0.0.0 up to 2.8.0 - this is a non-default configuration requiring deliberate module installation. The CVSS vector (PR:N, UI:R) confirms that the attacker requires no authentication to submit the malicious payload, but exploitation is gated by the requirement that a victim user actively loads the page where the stored payload is rendered (UI:R). Exploitation is not automatable per SSVC, meaning bulk scanning and instant weaponization are not practical. Impact is bounded to confidentiality and integrity (C:L/I:L); no availability impact applies. Sites that restrict the feedback submission form to authenticated users effectively raise the privilege bar to PR:L and meaningfully reduce exposure.

The CVSS 6.1 Medium score is derived from a network-accessible, low-complexity attack requiring no privileges but mandatory user interaction (UI:R), with a scope change (S:C) that elevates the score despite only partial confidentiality and integrity impact. Real-world risk signals substantially temper urgency: EPSS at 0.16% places this in the 6th percentile of exploitation likelihood, SSVC classifies exploitation as 'none' with a non-automatable attack path and only partial technical impact, and the vulnerability has not been added to CISA KEV. The niche deployment footprint of a contributed Drupal feedback module further limits aggregate exposure. The most plausible high-risk scenario involves admin users encountering the stored payload, which could yield session token theft or CSRF-level privilege escalation - a meaningful but bounded impact. Overall, this is a genuine vulnerability warranting patch application during the next maintenance window but does not require emergency response.

An unauthenticated attacker visits the content feedback submission interface of a Drupal site running a vulnerable version of admin_feedback and submits a feedback entry containing a crafted JavaScript payload such as a cookie-stealing script. The payload is stored in the Drupal database and silently executes the next time an administrator or privileged user loads the affected feedback or content review page, transmitting their session token to an attacker-controlled endpoint and enabling subsequent account takeover. No public proof-of-concept code has been identified, but the attack technique is well-understood and the barrier to manual exploitation is low.