Lunr Exposed Filters EUVD-2026-66204

Exploitation requires all of the following conditions simultaneously: the Drupal Lunr Exposed Filters module must be installed and enabled on the target site (all versions *.*); the attacker must already possess high-privilege access to the Drupal application (PR:H - consistent with administrator or equivalent role); the attack path involves high complexity (AC:H), indicating a non-trivial, multi-step approach rather than a simple request; and user interaction (UI:R) from another party must be induced to trigger the vulnerability. Exploitation is ruled out for unauthenticated remote attackers, low-privilege users, or attackers targeting sites that have not installed this contributed module. The combination of PR:H and UI:R is particularly limiting: the attacker must already operate within a position of trust on the system.

The published CVSS 5.7 score and C:H/I:H impact components appear alarming in isolation, but the four concurrent exploitation constraints - AC:H (high complexity), PR:H (high privileges), UI:R (user interaction required), and S:U (no scope change) - collectively represent a very narrow attack surface. EPSS at 0.14% (4th percentile) aligns with this assessment and indicates minimal real-world exploitation pressure. There is no CISA KEV listing and no known public proof-of-concept. The 'Information Disclosure' tag correlates with C:H, but the I:H (integrity) rating is not explained by available data and warrants clarification from the vendor advisory at https://www.drupal.org/sa-contrib-2026-086. The PR:H requirement restricts the threat actor pool almost exclusively to insiders or attackers who have already fully compromised a privileged Drupal account, significantly reducing incremental risk. This is not a drive-by or mass-exploitation candidate.

An attacker who has obtained or already holds high-privilege Drupal administrative access crafts a malformed input value targeting a Lunr exposed filter endpoint, then engineers a scenario requiring another authenticated user to interact - for example, by sharing a crafted URL or triggering a specific UI action. Upon triggering the improper input validation flaw, the attacker can access sensitive data otherwise restricted by the application's access controls, or manipulate data integrity. No public proof-of-concept exists, and the multi-step prerequisite chain makes this a low-probability, targeted attack path.