Cross-Site Request Forgery (CSRF) vulnerability in Drupal Project Browser allows Cross Site Request Forgery. (CVE-2026-96374)

The Drupal Project Browser module contains a CSRF vulnerability identified as CVE-2026-96374. This vulnerability affects versions from 0.0.0 up to 2.0.3 and from 2.1.0 up to 2.1.5. The issue allows an attacker to perform Cross-Site Request Forgery attacks, potentially causing unauthorized actions to be executed with the privileges of an authenticated user. The CVSS 3.1 vector indicates the attack requires network access, high attack complexity, no privileges, and user interaction, with limited confidentiality and integrity impact and no availability impact.

Successful exploitation of this vulnerability could allow an attacker to induce users to perform unintended actions within the Drupal Project Browser module, potentially leading to limited confidentiality and integrity impacts. The vulnerability does not affect availability and requires user interaction and high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections such as verifying anti-CSRF tokens in requests or restricting access to trusted users. Monitor official Drupal advisories for updates and patches addressing this vulnerability.