EUVD-2026-69991
GHSA-qgvw-q84r-4fxw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-reachable SSRF requiring no authentication or interaction; C:L reflects limited internal resource disclosure with no integrity or availability impact.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
4DescriptionCVE.org
Server-Side Request Forgery (SSRF) vulnerability in Drupal Entity Share Websub allows Server Side Request Forgery. This issue affects Entity Share Websub versions: from 0.0.0 to 1.1.2.
AnalysisAI
Server-Side Request Forgery in Drupal's Entity Share Websub contributed module (versions 0.0.0 through < 1.1.2) allows unauthenticated remote attackers to induce the Drupal server to issue outbound HTTP requests to attacker-controlled targets, including internal network resources and cloud metadata endpoints. The vulnerability is rated CVSS 5.3 Medium with limited confidentiality impact and no integrity or availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The Drupal installation must have the Entity Share Websub contributed module installed and enabled in a version from 0.0.0 through < 1.1.2. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.3 Medium rating reflects an unauthenticated, network-reachable flaw with low complexity and limited confidentiality impact (C:L), with no integrity or availability consequences and an unchanged scope. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Entity Share Websub Drupal module to version 1.1.2 or later, as documented in Drupal Security Advisory SA-CONTRIB-2026-097 at https://www.drupal.org/sa-contrib-2026-097. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today