SA-CONTRIB-2026-330: CSRF
This module enables you to create custom pages and to override existing paths, such as node or user pages, with variants that are selected by conditions. The Page Manager UI submodule doesn't sufficiently protect against cross-site request forgery (CSRF). An attacker could trick a user with permission to administer pages into enabling or disabling a page without their knowledge. This vulnerability is mitigated by the fact that the Page Manager UI submodule must be enabled, and the targeted user must have the "administer pages" permission.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/page_managerto a version that resolves this vulnerability.Fixed in 8.x-4.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites are exposed only if the Page Manager UI submodule is enabled and a user has the "administer pages" permission. Users without that permission cannot be targeted to make the described page-management changes.
What must an attacker do to exploit it?
An attacker must trick a user who has the "administer pages" permission into making a request that enables or disables a page. The issue is a cross-site request forgery weakness in the Page Manager UI submodule.
How can I determine whether my site is affected?
Check whether the Page Manager UI submodule is enabled and whether any accounts have the "administer pages" permission. If both conditions are present, the described attack path applies.
What can be done if patching is not immediately possible?
Disable the Page Manager UI submodule if it is not needed, and limit the "administer pages" permission to only necessary, trusted users. This removes or reduces the conditions required for exploitation.