Cross-Site Request Forgery (CSRF) vulnerability in Drupal Acquia Content Hub allows Cross Site Request Forgery.This issue affects Acquia Content Hub: from 0.0.0 before 3.6.4, from 3.7.0 before 3.7.3.

The CSRF vulnerability in Drupal Acquia Content Hub allows an attacker to trick a logged-in user into unknowingly executing malicious actions. For example, an attacker could craft a malicious link or embed it in an email, causing the user's browser to send a forged request to the server. This could result in unauthorized content creation, modification, or deletion, impacting the integrity of the content hub. The blast radius extends to any user with access to the Acquia Content Hub, as their actions could be hijacked. Successful exploitation could also lead to privilege escalation if the user has administrative rights.

Organizations using Drupal Acquia Content Hub for content management are at risk, particularly those running versions 3.7.0 through 3.7.3. Shared hosting environments where multiple users share the same Drupal instance are especially vulnerable, as an attacker could potentially compromise the accounts of other users.

• drupal: Check Drupal core files for suspicious code related to form handling and CSRF tokens.

grep -r 'CSRF token' /var/www/html/drupal/core/modules/system/system.form

• drupal: Review Drupal logs for unusual activity or failed CSRF token validation attempts.

journalctl -u apache2 -f | grep "CSRF token validation failed"

• generic web: Monitor access logs for requests with unexpected parameters or originating from unusual sources.

 grep -i 'csrf' /var/log/apache2/access.log

1. 2026-01-28Disclosure

   disclosure

1. Reserviert2025-12-10
2. Veröffentlicht2026-01-28
3. Geändert2026-02-06
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-14472 is to upgrade Acquia Content Hub to version 3.6.4 or later, which contains the fix. If immediate upgrading is not possible, implement strict input validation and output encoding to prevent the injection of malicious scripts. Consider using a Web Application Firewall (WAF) with CSRF protection rules to filter out suspicious requests. Review and strengthen user access controls to limit the potential impact of a successful attack. After upgrading, verify the fix by attempting to trigger a CSRF attack and confirming that it is blocked.