Cross-Site Request Forgery (CSRF) vulnerability in Drupal Automated Logout allows Cross Site Request Forgery.This issue affects Automated Logout: from 0.0.0 before 1.7.0, from 2.0.0 before 2.0.2.

This CSRF vulnerability allows an attacker to trick a logged-in user into unknowingly performing actions they did not intend. Successful exploitation could lead to unauthorized modifications of Automated Logout settings, potentially impacting user session management and security policies within the Drupal site. The attacker needs to craft a malicious request that the user unknowingly submits, leveraging their authenticated session. While the direct impact may seem limited to the Automated Logout module, a compromised configuration could have broader implications for site security.

Websites using Drupal with the Automated Logout module installed, particularly those running vulnerable versions (2.0.0–8.x-1.7). Sites with less stringent access controls to the Automated Logout configuration are at higher risk.

• drupal / module: Check Drupal module versions for Automated Logout.

  drush pm-info --title --core --modules --themes --profiles | grep Automated Logout

• drupal / configuration: Review Automated Logout configuration settings for unexpected changes. • generic web: Monitor access logs for suspicious requests targeting Automated Logout endpoints.

1. 2026-03-26Disclosure

   disclosure

1. Reserviert2026-03-18
2. Veröffentlicht2026-03-26
3. Geändert2026-04-01
4. EPSS aktualisiert2026-04-03

The primary mitigation is to upgrade Drupal Automated Logout to version 2.0.2 or later. If immediate upgrading is not feasible, consider implementing strict input validation and output encoding within the Automated Logout module to prevent malicious requests. Additionally, implement CSRF protection mechanisms at the Drupal application level, such as using CSRF tokens for all sensitive operations. Review and restrict access to Automated Logout configuration pages to authorized personnel only.