SA-CONTRIB-2026-283: CSRF
This module enables you to quickly toggle the publication status, promotion and stickiness of nodes, and the publication status of comments, from links on the page. The module doesn't sufficiently protect against cross-site request forgery (CSRF) on its toggle URL, under the scenario where a user with the "Use Fasttoggle" permission visits a page controlled by an attacker while logged in. This allows the attacker to change the publication status of arbitrary content on behalf of that user. This vulnerability is mitigated by the fact that an attacker must trick a user with the permission "Use Fasttoggle" into visiting an attacker-controlled page.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/fasttoggleto a version that resolves this vulnerability.Fixed in 4.1.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users who have the "Use Fasttoggle" permission are exposed if they visit an attacker-controlled page while logged in. The attacker can then change publication status for arbitrary content on that user's behalf.
What must an attacker do to exploit the vulnerability?
The attacker must trick a logged-in user with the "Use Fasttoggle" permission into visiting a page controlled by the attacker. The vulnerable toggle URL does not sufficiently protect against CSRF requests.
What kinds of changes can be made through the vulnerable functionality?
The module's toggle functionality can change node publication status, promotion, and stickiness, as well as comment publication status. The advisory specifically states that publication status of arbitrary content can be changed through exploitation.