WID-SEC-W-2026-0250

DeutschShown in its original language — a full translation is planned for a future version.

Drupal Canvas und CAS: Mehrere Schwachstellen

view advisory published 2026-01-28

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um Sicherheitsvorkehrungen zu umgehen oder Daten zu manipulieren.

describes (2)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-1554US	—	0.18% (7th)	—	2026-02-04
XML Injection (aka Blind XPath Injection) vulnerability in Drupal Central Authentication System (CAS) Server allows Privilege Escalation.This issue affects Central Authentication S…
CVE-2026-1553US	—OT elevated	0.16% (5th)	—	2026-02-04
Incorrect Authorization vulnerability in Drupal Drupal Canvas allows Forceful Browsing.This issue affects Drupal Canvas: from 0.0.0 before 1.0.4.

references

External citations — patches, advisories, analysis.

WID-SEC-W-2026-0250 - CSAF Versionself
WID-SEC-2026-0250 - Portal Versionself
Drupal Security Advisory vom 2026-01-28external
Drupal Security Advisory vom 2026-01-28external

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan