SA-CONTRIB-2026-178: CSRF
The Project Browser module enables you to apply recipes and enable modules from the web user interface. The module doesn't sufficiently validate admin actions to protect against cross-site request forgery attacks (CSRF).
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/project_browserto a version that resolves this vulnerability.Fixed in 2.1.5Fixed in 2.0.3
Event History
Frequently Asked Questions
Who could be exposed to this issue?
Sites using the Project Browser module are exposed because it allows recipes to be applied and modules to be enabled through the web user interface.
What would an attacker need to exploit it?
An attacker would need to cause an administrator to perform a forged web request. The issue is a lack of sufficient CSRF validation for administrative actions.
What actions could a successful attack trigger?
A successful CSRF attack could cause administrative actions in Project Browser, including applying recipes or enabling modules through the web interface.