CVE-2026-126739: CSRF

Q: Which deployments are exposed to this issue?

Only deployments with the Page Manager UI submodule enabled are affected. Exploitation also requires interaction from a user who has the "administer pages" permission.

Q: What access does an attacker need to exploit it?

The attacker does not need the ability to administer pages themselves, but must be able to trick a user with that permission into making a request. Successful exploitation can enable or disable a page without that user's knowledge.

Published Nov 11, 2026

Updated

This module enables you to create custom pages and to override existing paths, such as node or user pages, with variants that are selected by conditions.

The Page Manager UI submodule doesn't sufficiently protect against cross-site request forgery (CSRF). An attacker could trick a user with permission to administer pages into enabling or disabling a page without their knowledge.

This vulnerability is mitigated by the fact that the Page Manager UI submodule must be enabled, and the targeted user must have the "administer pages" permission.

Affected Software

1 affected componentFixes available

composer/drupal/page_manager<4.1.0

4.1.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/page_manager to a version that resolves this vulnerability.
Fixed in 4.1.0

Event History

Nov 11, 2026

Advisory Published

via OSV·05:57 PM

Data Sourced

via OSV·05:57 PM

DescriptionAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Only deployments with the Page Manager UI submodule enabled are affected. Exploitation also requires interaction from a user who has the "administer pages" permission.

What access does an attacker need to exploit it?

The attacker does not need the ability to administer pages themselves, but must be able to trick a user with that permission into making a request. Successful exploitation can enable or disable a page without that user's knowledge.