PT-2026-22083 · Drupal+3 · Theme Negotiation By Rules+2

Damien Mckenna + 3 · CVE-2026-3211 · Publicado 2026-02-25 · Atualizado 2026-03-30

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Drupal Theme Negotiation by Rules versions prior to 1.2.1

Description A Cross-Site Request Forgery (CSRF) issue exists in the Theme Negotiation by Rules module. The module allows site builders to create “theme rule” config entities to render pages with different themes based on specific conditions. The module utilizes a simple GET request to disable or enable theme rules, enabling attackers to manipulate these rules by deceiving site administrators into clicking malicious links. Successful exploitation requires the attacker to know the machine name of the theme rule.

Recommendations Update to version 1.2.1 or later.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2026-3211

DRUPAL-CONTRIB-2026-012

Produtos afetados

Theme Negotiation By Rules

Drupal/Theme Rule

Theme Rule

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3211.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-3211 · Nota de Segurança
• https://git.drupalcode.org/project/theme_rule · Nota
• https://drupal.org/project/theme_rule · Nota
• https://twitter.com/CVEnew/status/2038618167866544173 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-3211 · Aviso do Fabricante
• https://osv.dev/vulnerability/DRUPAL-CONTRIB-2026-012 · Aviso do Fabricante
• https://drupal.org/sa-contrib-2026-012 · Aviso do Fabricante
• https://twitter.com/infoflowcloud/status/2038620279790870766 · Publicação no Twitter