CVE-2026-55808 is a CWE-79 Cross-Site Scripting vulnerability in Drupal core caused by improper neutralization of input during web page generation. It affects Drupal core versions from initial releases up to 10.5.12, 10.6.0 through 10.6.11, 11.2.0 through 11.2.14, and 11.3.0 through 11.3.12, as well as all 11.0.* and 11.1.* versions. The vulnerability allows an attacker with low privileges and requiring user interaction to execute script code, potentially impacting confidentiality and integrity of user data. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, and scope change with limited confidentiality and integrity impact and no availability impact. No known exploits in the wild or vendor remediation details are currently available.

An attacker with low privileges and requiring user interaction can exploit this vulnerability to execute arbitrary scripts in the context of other users. This can lead to limited confidentiality and integrity impacts, such as theft of user session data or manipulation of displayed content. There is no impact on availability. The vulnerability affects multiple Drupal core versions, potentially exposing many deployments until fixed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should monitor Drupal security advisories for updates. Applying any recommended updates promptly once available is advised. No specific temporary mitigations are provided in the current data.