PT-2026-26218 · Drupal · Drupal Automated Logout

Ajit Shinde + 6 · Published 2026-03-18 · Updated 2026-03-26 · CVE-2026-4393

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Drupal Automated Logout versions 0.0.0 through 1.6.9 Drupal Automated Logout versions 2.0.0 through 2.0.1

Description The Automated Logout module for Drupal does not adequately protect its routes against Cross-Site Request Forgery (CSRF). This allows an attacker to trigger the logout route without the user’s knowledge or consent. The module is designed to allow site administrators to log users out after a period of inactivity.

Recommendations Update Drupal Automated Logout to version 1.7.0 or later. Update Drupal Automated Logout to version 2.0.2 or later.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-4393

DRUPAL-CONTRIB-2026-030

Affected Products

Drupal Automated Logout

References · 4

• https://osv.dev/vulnerability/DRUPAL-CONTRIB-2026-030 · Vendor Advisory
• https://drupal.org/sa-contrib-2026-030 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-4393 · Security Note
• https://twitter.com/CVEnew/status/2037280539582095513 · Twitter Post