DRUPAL-CONTRIB-2026-178

See a problem?
Import Source
https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/project_browser/DRUPAL-CONTRIB-2026-178.json
JSON Data
https://api.osv.dev/v1/vulns/DRUPAL-CONTRIB-2026-178
Aliases
  • CVE-2026-96374
Published
2026-09-23T16:53:01Z
Modified
2026-09-23T19:15:03Z
Summary
[none]
Details

The Project Browser module enables you to apply recipes and enable modules from the web user interface.

The module doesn't sufficiently validate admin actions to protect against cross-site request forgery attacks (CSRF).

References
Credits

Affected packages

Packagist:https://packages.drupal.org/8 / drupal/project_browser

Package

Name
drupal/project_browser
Purl
pkg:composer/drupal/project_browser?repository_url=https:%2F%2Fpackages.drupal.org%2F8

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.0.3
Database specific
Show details 
{
    "constraint":  "<2.0.3"
}
Type
ECOSYSTEM
Events
Introduced
2.1.0
Fixed
2.1.5
Database specific
Show details 
{
    "constraint":  ">=2.1.0 <2.1.5"
}

Database specific

affected_versions 
"<2.0.3 || >=2.1.0 <2.1.5"
source 
"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/project_browser/DRUPAL-CONTRIB-2026-178.json"