DRUPAL-CONTRIB-2026-283: CSRF

Q: Who is exposed to this issue?

Users who are logged in and have the "Use Fasttoggle" permission are exposed if they visit a page controlled by an attacker. The attacker can act on content using that user's privileges.

Q: What must an attacker do to exploit it?

The attacker must convince a logged-in user with the "Use Fasttoggle" permission to visit an attacker-controlled page. The vulnerable toggle URL can then be used to change publication status on arbitrary content on the user's behalf.

Q: What content changes can result from exploitation?

An attacker can change the publication status of arbitrary content on behalf of the affected user. The module also provides toggles for promotion, stickiness, and comment publication status, but the provided vulnerability details specifically confirm publication-status changes.

Published Oct 28, 2026

Updated

This module enables you to quickly toggle the publication status, promotion and stickiness of nodes, and the publication status of comments, from links on the page.

The module doesn't sufficiently protect against cross-site request forgery (CSRF) on its toggle URL, under the scenario where a user with the "Use Fasttoggle" permission visits a page controlled by an attacker while logged in. This allows the attacker to change the publication status of arbitrary content on behalf of that user.

This vulnerability is mitigated by the fact that an attacker must trick a user with the permission "Use Fasttoggle" into visiting an attacker-controlled page.

Affected Software

1 affected componentFixes available

composer/drupal/fasttoggle<4.1.1

4.1.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/fasttoggle to a version that resolves this vulnerability.
Fixed in 4.1.1

Event History

Oct 28, 2026

Advisory Published

via OSV·05:28 PM

Data Sourced

via OSV·05:28 PM

DescriptionAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Users who are logged in and have the "Use Fasttoggle" permission are exposed if they visit a page controlled by an attacker. The attacker can act on content using that user's privileges.

What must an attacker do to exploit it?

The attacker must convince a logged-in user with the "Use Fasttoggle" permission to visit an attacker-controlled page. The vulnerable toggle URL can then be used to change publication status on arbitrary content on the user's behalf.

What content changes can result from exploitation?

An attacker can change the publication status of arbitrary content on behalf of the affected user. The module also provides toggles for promotion, stickiness, and comment publication status, but the provided vulnerability details specifically confirm publication-status changes.

DRUPAL-CONTRIB-2026-283: CSRF

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker do to exploit it?

What content changes can result from exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker do to exploit it?

What content changes can result from exploitation?