DRUPAL-CONTRIB-2026-330: CSRF

Q: Who is exposed to this issue?

Sites are exposed only when the Page Manager UI submodule is enabled and a user has the "administer pages" permission. The impact is limited to actions that enable or disable pages through that UI.

Q: What does an attacker need to exploit it?

An attacker must be able to trick a user who has the "administer pages" permission into making a request. The issue is a cross-site request forgery weakness, so the attacker does not need that permission themselves.

Published Nov 11, 2026

Updated

This module enables you to create custom pages and to override existing paths, such as node or user pages, with variants that are selected by conditions.

The Page Manager UI submodule doesn't sufficiently protect against cross-site request forgery (CSRF). An attacker could trick a user with permission to administer pages into enabling or disabling a page without their knowledge.

This vulnerability is mitigated by the fact that the Page Manager UI submodule must be enabled, and the targeted user must have the "administer pages" permission.

Affected Software

1 affected componentFixes available

composer/drupal/page_manager<4.1.0

4.1.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/page_manager to a version that resolves this vulnerability.
Fixed in 4.1.0

Event History

Nov 11, 2026

Advisory Published

via OSV·05:57 PM

Data Sourced

via OSV·05:57 PM

DescriptionAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Sites are exposed only when the Page Manager UI submodule is enabled and a user has the "administer pages" permission. The impact is limited to actions that enable or disable pages through that UI.

What does an attacker need to exploit it?

An attacker must be able to trick a user who has the "administer pages" permission into making a request. The issue is a cross-site request forgery weakness, so the attacker does not need that permission themselves.

DRUPAL-CONTRIB-2026-330: CSRF

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?