Drupal Automated Logoutにおけるクロスサイトリクエストフォージェリ (CSRF) の脆弱性により、クロスサイトリクエストフォージェリが発生する可能性があります。この問題は、Automated Logout: 0.0.0より前、1.7.0より前、および2.0.0より前、2.0.2より前のバージョンに影響を与えます。

This CSRF vulnerability allows an attacker to trick a logged-in user into unknowingly performing actions they did not intend. Successful exploitation could lead to unauthorized modifications of Automated Logout settings, potentially impacting user session management and security policies within the Drupal site. The attacker needs to craft a malicious request that the user unknowingly submits, leveraging their authenticated session. While the direct impact may seem limited to the Automated Logout module, a compromised configuration could have broader implications for site security.

Websites using Drupal with the Automated Logout module installed, particularly those running vulnerable versions (2.0.0–8.x-1.7). Sites with less stringent access controls to the Automated Logout configuration are at higher risk.

• drupal / module: Check Drupal module versions for Automated Logout.

  drush pm-info --title --core --modules --themes --profiles | grep Automated Logout

• drupal / configuration: Review Automated Logout configuration settings for unexpected changes. • generic web: Monitor access logs for suspicious requests targeting Automated Logout endpoints.

1. 2026-03-26Disclosure

   disclosure

1. 予約済み2026-03-18
2. 公開日2026-03-26
3. 更新日2026-04-01
4. EPSS 更新日2026-04-03

The primary mitigation is to upgrade Drupal Automated Logout to version 2.0.2 or later. If immediate upgrading is not feasible, consider implementing strict input validation and output encoding within the Automated Logout module to prevent malicious requests. Additionally, implement CSRF protection mechanisms at the Drupal application level, such as using CSRF tokens for all sensitive operations. Review and restrict access to Automated Logout configuration pages to authorized personnel only.