SA-CONTRIB-2026-326: CSRF
This module integrates the Campaign Monitor API into Drupal so that users can subscribe and unsubscribe for your Campaign Monitor. It manages lists through a block on your Drupal site. The module doesn't sufficiently protect against cross-site request forgery (CSRF) on its admin routes. This vulnerability is mitigated by the fact that an attacker must craft and embed into a Drupal site a link with exact ID of a Campaign Monitor list for user with administer campaignmonitor permission to click.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/campaignmonitorto a version that resolves this vulnerability.Fixed in 3.0.3
Event History
Frequently Asked Questions
Who is exposed to this issue?
Drupal sites using composer/drupal/campaignmonitor are exposed if a user has the administer campaignmonitor permission and can be induced to follow a crafted link on the Drupal site.
What does an attacker need to exploit it?
The attacker must craft and embed a link containing the exact ID of a Campaign Monitor list, then cause a user with the administer campaignmonitor permission to click it.