Drupal Theme Negotiation by Rules における Cross-Site Request Forgery (CSRF) の脆弱性により、Cross Site Request Forgery が可能となる。この問題は Theme Negotiation by Rules: 0.0.0 より前の 1.2.1 に影響する。

The CSRF vulnerability in Drupal Theme Negotiation by Rules allows an attacker to craft malicious requests that appear to originate from a legitimate user. If successful, an attacker could modify theme negotiation rules, potentially altering how the site renders content or redirects users. This could lead to defacement, redirection to malicious websites, or even the execution of arbitrary code if the theme negotiation rules are exploited in conjunction with other vulnerabilities. The blast radius extends to any user with access to the administrative interface, as their actions could be hijacked.

Drupal sites utilizing the Theme Negotiation by Rules module, particularly those running versions prior to 1.2.1, are at risk. Sites with less stringent security practices or those that haven't implemented CSRF protection mechanisms are particularly vulnerable.

• drupal:

find /var/www/html -name 'theme_negotiation_by_rules.module' -print0 | xargs -0 grep -i 'DRUPAL_CORE_VERSION' 

• generic web:

curl -I https://your-drupal-site.com/ | grep -i 'content-type'

1. 2026-03-25Disclosure

   disclosure

1. 予約済み2026-02-25
2. 公開日2026-03-25
3. 更新日2026-03-31
4. EPSS 更新日2026-04-02

The primary mitigation for CVE-2026-3211 is to immediately upgrade Drupal Theme Negotiation by Rules to version 1.2.1 or later. If upgrading is not immediately feasible, consider implementing strict input validation and output encoding on all user-supplied data used in theme negotiation rules. Implementing a CSRF protection mechanism, such as a token system, can also help mitigate the risk. After upgrading, confirm the fix by attempting to submit a malicious request and verifying that it is blocked.