CVE-2026-73474
Awaiting Analysis Awaiting Analysis - Queue

SSRF Vulnerability in Drupal Entity Share Websub

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: Drupal.org

Description
Server-Side Request Forgery (SSRF) vulnerability in Drupal Entity Share Websub allows Server Side Request Forgery. This issue affects Entity Share Websub versions: from 0.0.0 to 1.1.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-73474
EUVD
EUVD-2026-69991

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
drupal entity_share_websub From 0.0.0 (inc) to 1.1.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in the Drupal Entity Share Websub module. It allows attackers to make server-side requests to unintended internal systems by manipulating crafted inputs. The flaw exists in versions 0.0.0 to 1.1.2 of the module.

Impact Analysis

An attacker could exploit this to access internal services, bypass firewalls, or exfiltrate sensitive data from your server. It may lead to unauthorized information disclosure, network reconnaissance, or further attacks on internal systems.

Compliance Impact

SSRF vulnerabilities can violate compliance requirements by exposing sensitive data or internal systems. GDPR may require breach notification if personal data is accessed. HIPAA could be violated if protected health information is compromised due to unauthorized access.

Mitigation Strategies

Update Drupal Entity Share Websub to the latest version beyond 1.1.2 to address the SSRF vulnerability. Disable or remove the module if not in use. Monitor network traffic for unusual requests originating from the server.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73474. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart