CVE-2026-126735: CSRF
This module integrates the Campaign Monitor API into Drupal so that users can subscribe and unsubscribe for your Campaign Monitor. It manages lists through a block on your Drupal site.
The module doesn't sufficiently protect against cross-site request forgery (CSRF) on its admin routes.
This vulnerability is mitigated by the fact that an attacker must craft and embed into a Drupal site a link with exact ID of a Campaign Monitor list for user with administer campaignmonitor permission to click.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/campaignmonitorto a version that resolves this vulnerability.Fixed in 3.0.3
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Drupal sites using composer/drupal/campaignmonitor are exposed on the module's administrative routes. Exploitation requires a user who has the administer campaignmonitor permission to interact with an attacker-crafted link.
What does an attacker need to exploit it?
The attacker must craft and embed a link in the Drupal site that contains the exact ID of a Campaign Monitor list, then cause a user with administer campaignmonitor permission to click it.
Are ordinary site visitors sufficient to trigger the issue?
No. The described attack depends on a click by a user holding the administer campaignmonitor permission; the data does not indicate that an unauthenticated or ordinary user alone can complete exploitation.