CVE-2026-13243 is a CWE-352 Cross-Site Request Forgery vulnerability in the Drupal Salesforce Suite module. It affects all versions from 0.0.0 through 5.1.3. The vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated user without their consent. The CVSS v3.1 base score is 4.8, with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity but not availability. The product is a cloud-hosted service, and the vendor manages remediation for this service.

Exploitation of this vulnerability could lead to unauthorized actions being performed using the privileges of an authenticated user, potentially compromising confidentiality and integrity of data handled by the Salesforce Suite module. There is no known exploitation in the wild at this time.

Since the Salesforce Suite is a cloud-hosted service, the vendor (Drupal) manages remediation server-side. A patch is available, and users should verify with the vendor advisory that their instance has been updated. No additional action may be required if the vendor has already applied the fix.