CVE-2026-73474: CWE-918 Server-Side Request Forgery (SSRF) in Drupal Entity Share Websub

This vulnerability, identified as CWE-918, exists in the Drupal Entity Share Websub module and allows an attacker to perform Server-Side Request Forgery (SSRF). This means the attacker can cause the server to send crafted HTTP requests to internal or external systems, potentially bypassing network restrictions. The affected versions include 0.0.0 through 1.1.2. The CVSS v3.1 base score is 5.3, reflecting a medium impact primarily on confidentiality. No official fix or patch has been documented yet.

The SSRF vulnerability could allow an attacker to make the vulnerable server initiate requests to arbitrary URLs, potentially exposing internal services or sensitive information. The CVSS vector indicates no privileges or user interaction are required, and the impact is limited to partial confidentiality loss without integrity or availability impact. There are no reports of active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider restricting network access from the affected module or applying any available workarounds recommended by Drupal. Monitor official Drupal security advisories for updates.