{"id":"DRUPAL-CONTRIB-2026-178","aliases":["CVE-2026-96374"],"title":"DRUPAL-CONTRIB-2026-178","description":"The Project Browser module enables you to apply recipes and enable modules from the web user interface.\n\nThe module doesn't sufficiently validate admin actions to protect against cross-site request forgery attacks (CSRF).","severity":"unknown","score":null,"published":"2026-09-23T16:53:01.000Z","modified":"2026-09-23T19:15:03.881Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist:https://packages.drupal.org/8","name":"drupal/project_browser","ranges":[{"events":[{"introduced":"0"},{"fixed":"2.0.3"}],"type":"ECOSYSTEM","database_specific":{"constraint":"<2.0.3"}},{"events":[{"introduced":"2.1.0"},{"fixed":"2.1.5"}],"type":"ECOSYSTEM","database_specific":{"constraint":">=2.1.0 <2.1.5"}}],"versions":[],"fixed":["2.0.3","2.1.5"]}],"references":["https://www.drupal.org/sa-contrib-2026-178"],"sources":[{"name":"OSV","id":"DRUPAL-CONTRIB-2026-178","modified":"2026-09-23T19:15:03.881478012Z","url":"https://osv.dev/vulnerability/DRUPAL-CONTRIB-2026-178"}],"assessments":[]}