{"id":"CVE-2026-114541","kind":"vulnerability","aliases":["CVE-2026-114541"],"related":[],"title":"Drupal Frontend Editing: CSRF flaw lets forged requests act as users","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Frontend Editing allows Cross Site Request Forgery. This issue affects Frontend Editing versions: from 0.0.0 to 1.9.3.","summary":"The Drupal Frontend Editing module has a cross-site request forgery flaw in versions 0.0.0 through 1.9.3. A malicious page can make a logged-in user's browser send requests to the site that the user did not intend.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","frontend-editing","package","self-hosted"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed Frontend Editing module version in the Drupal project (for example with `drush pm:list --filter=frontend_editing` or the Extend page).\n- Confirm whether the module is enabled on the site.","fix":"- Frontend Editing: move to a version later than `1.9.3` (the sources do not name the fixed version).","status":"open","published_at":"2026-10-30T04:18:13+00:00","first_seen_at":"2026-10-30T04:28:37+00:00","triaged_at":"2026-10-30T04:29:53+00:00","updated_at":"2026-10-30T04:29:53+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T04:29:53Z","model":"claude-haiku-5-5","output":{"fix":"- Frontend Editing: move to a version later than `1.9.3` (the sources do not name the fixed version).","reach":"internet","title":"Drupal Frontend Editing: CSRF flaw lets forged requests act as users","impact":"medium","summary":"The Drupal Frontend Editing module has a cross-site request forgery flaw in versions 0.0.0 through 1.9.3. A malicious page can make a logged-in user's browser send requests to the site that the user did not intend.","audience":"businesses","category":"package","nicknames":[],"who_cares":["drupal","frontend-editing","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Logged-in editors' actions are forged by attacker-controlled pages","analyst_note":"Check the NVD entry and the Drupal security advisory for the fixed version, affected editing actions and required roles.","how_to_check":"- Check the installed Frontend Editing module version in the Drupal project (for example with `drush pm:list --filter=frontend_editing` or the Extend page).\n- Confirm whether the module is enabled on the site.","plain_action":"","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Sites running the Drupal Frontend Editing module at version 1.9.3 or earlier are affected. Sites that do not install the module are not exposed. The sources do not describe the exact editing actions reachable or required user roles.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000685,"input_tokens":4108,"output_tokens":548,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-114541':14A,17A '-2026':13A,16A '0.0.0':41B,90C '1.9.3':43B,92C 'act':9A 'affect':85C 'allow':78C 'browser':55B 'cross':34B,68C,79C 'cross-sit':33B,67C 'csrf':4A,72C 'cve':12A,15A 'drupal':1A,18B,27B,75C 'edit':3A,21B,29B,77C,87C 'flaw':5A,38B 'forg':7A 'forgeri':37B,71C,82C 'frontend':2A,20B,28B,76C,86C 'frontend-edit':19B 'host':25B 'intend':66B 'issu':84C 'let':6A 'log':51B 'logged-in':50B 'make':48B 'malici':45B 'modul':30B 'packag':22B 'page':46B 'request':8A,36B,57B,70C,81C 'self':24B 'self-host':23B 'send':56B 'site':35B,60B,69C,80C 'user':11A,53B,63B 'version':40B,88C 'vulner':73C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Drupal Frontend Editing module at version 1.9.3 or earlier are affected. Sites that do not install the module are not exposed. The sources do not describe the exact editing actions reachable or required user roles.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:18:13+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114541","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114541","severity":null,"published_at":"2026-10-30T04:18:13+00:00","modified_at":"2026-10-30T04:18:13+00:00","first_seen_at":"2026-10-30T04:28:37+00:00","fetched_at":"2026-10-30T04:28:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}