PT-2026-26218 · Drupal · Drupal Automated Logout

Ajit Shinde + 6 · Publicado 2026-03-18 · Atualizado 2026-03-26 · CVE-2026-4393

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Drupal Automated Logout versions 0.0.0 through 1.6.9 Drupal Automated Logout versions 2.0.0 through 2.0.1

Description The Automated Logout module for Drupal does not adequately protect its routes against Cross-Site Request Forgery (CSRF). This allows an attacker to trigger the logout route without the user’s knowledge or consent. The module is designed to allow site administrators to log users out after a period of inactivity.

Recommendations Update Drupal Automated Logout to version 1.7.0 or later. Update Drupal Automated Logout to version 2.0.2 or later.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2026-4393

DRUPAL-CONTRIB-2026-030

Produtos afetados

Drupal Automated Logout

Referências · 4

• https://osv.dev/vulnerability/DRUPAL-CONTRIB-2026-030 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2037280539582095513 · Publicação no Twitter
• https://drupal.org/sa-contrib-2026-030 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-4393 · Nota de Segurança