CVE-2026-55806
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
An Open Redirect vulnerability in Drupal core allows URL redirection to untrusted sites, enabling content spoofing. This affects Drupal core versions from 0.0.0 to 10.5.12, 10.6.0 to 10.6.11, 11.2.0 to 11.2.14, 11.3.0 to 11.3.12, and older branches 11.0.* and 11.1.*.
Risk Assessment
Attackers can exploit this flaw to redirect users to malicious sites, impersonating the legitimate website, increasing the risk of data theft or malware infection.
Recommendation
Immediately update Drupal core to the latest patched version that fixes this vulnerability. As a temporary measure, consider implementing WAF rules to block suspicious redirects.
Other vulnerabilities in Drupal core
See all- CVE-2026-55805Medium
Drupal core has a Stored XSS vulnerability due to improper neutralization of input during web page generation. Affected versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, and some 11.0.*, 11.1.*, 11.2.* versions.
- CVE-2026-15917Medium
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects versions: from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, and all versions up to 11.2.*.
- CVE-2026-15916Medium
Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects versions: up to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, and all versions up to 11.0.*, 11.1.*, and 11.2.*.
- CVE-2026-55808Medium
A Cross-Site Scripting (XSS) vulnerability has been discovered in Drupal Core due to improper input neutralization during web page generation. It affects a wide range of versions: from 0.0.0 to 10.5.12, 10.6.0-10.6.11, 11.2.0-11.2.14, 11.3.0-11.3.12, and all 11.0.* and 11.1.* releases.
- CVE-2026-55807Low
SSRF vulnerability in Drupal core allows an attacker to send requests from the server to internal network resources. The issue affects multiple Drupal versions including 10.5.x, 10.6.x, 11.2.x, 11.3.x, and older branches 11.0.x and 11.1.x.
- CVE-2026-55804Medium
An improperly controlled modification of dynamically-determined object attributes vulnerability in Drupal core allows object injection. Affected versions include Drupal core from 0.0.0 to 10.5.12, 10.6.0 to 10.6.11, 11.2.0 to 11.2.14, 11.3.0 to 11.3.12, and branches 11.0.* and 11.1.*.
- CVE-2026-55803Medium
An improperly controlled modification of dynamically-determined object attributes vulnerability in Drupal core allows object injection. This affects Drupal core versions from 0.0.0 to 10.5.12, 10.6.0 to 10.6.11, 11.2.0 to 11.2.14, 11.3.0 to 11.3.12, and older branches 11.0.* and 11.1.*.
- CVE-2026-6367Medium
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core: from 11.3.0 before 11.3.7.
- CVE-2026-6366Medium
Improperly controlled modification of dynamically-determined object attributes vulnerability in Drupal core allows object injection. Affects versions from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, and from 11.3.0 before 11.3.7.
- CVE-2026-6365Medium
Drupal core versions 8.0.0 to 10.5.9, 10.6.0 to 10.6.7, 11.0.0 to 11.2.11, and 11.3.0 to 11.3.7 are vulnerable to Cross-Site Scripting (XSS) due to improper input neutralization during page generation.
Original NVD description (English source)
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Drupal core allows Content Spoofing. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*.