DRUPAL-CONTRIB-2026-326: CSRF

Q: Who is realistically exposed to this CSRF issue?

Sites using composer/drupal/campaignmonitor are exposed on the module's administrative routes. Exploitation requires a user with the administer campaignmonitor permission to interact with an attacker-controlled link embedded in a Drupal site.

Q: What must an attacker know or do to exploit it?

The attacker must craft and embed a link containing the exact ID of a Campaign Monitor list. They must then cause a user who has the administer campaignmonitor permission to click that link.

Published Nov 11, 2026

Updated

This module integrates the Campaign Monitor API into Drupal so that users can subscribe and unsubscribe for your Campaign Monitor. It manages lists through a block on your Drupal site.

The module doesn't sufficiently protect against cross-site request forgery (CSRF) on its admin routes.

This vulnerability is mitigated by the fact that an attacker must craft and embed into a Drupal site a link with exact ID of a Campaign Monitor list for user with administer campaignmonitor permission to click.

Affected Software

1 affected componentFixes available

composer/drupal/campaignmonitor<3.0.3

3.0.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/campaignmonitor to a version that resolves this vulnerability.
Fixed in 3.0.3

Event History

Nov 11, 2026

Advisory Published

via OSV·05:51 PM

Data Sourced

via OSV·05:51 PM

DescriptionAffected Software

Frequently Asked Questions

Who is realistically exposed to this CSRF issue?

Sites using composer/drupal/campaignmonitor are exposed on the module's administrative routes. Exploitation requires a user with the administer campaignmonitor permission to interact with an attacker-controlled link embedded in a Drupal site.

What must an attacker know or do to exploit it?

The attacker must craft and embed a link containing the exact ID of a Campaign Monitor list. They must then cause a user who has the administer campaignmonitor permission to click that link.

DRUPAL-CONTRIB-2026-326: CSRF

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is realistically exposed to this CSRF issue?

What must an attacker know or do to exploit it?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this CSRF issue?

What must an attacker know or do to exploit it?