Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

2 vulnerabilities by drupal_canvas_project

CVE-2026-3216 (GCVE-0-2026-3216)

Vulnerability from cvelistv5 – Published: 2026-03-25 15:24 – Updated: 2026-03-27 13:58
VLAI?
Title
Drupal Canvas - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-017
Summary
Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal Canvas allows Server Side Request Forgery.This issue affects Drupal Canvas: from 0.0.0 before 1.1.1.
Severity ?
5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
CWE
  • CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
Impacted products
Vendor Product Version
Drupal Drupal Canvas Affected: 0.0.0 , < 1.1.1 (semver)
Create a notification for this product.
Date Public ?
2026-02-25 18:51
Credits
Drew Webber (mcdruid) Bálint Kléri (balintbrews) Ignacio Sánchez Holgueras (isholgueras) Drew Webber (mcdruid) Narendra Singh Rathore (narendrar) Christian López Espínola (penyaskito) Tim Plunkett (tim.plunkett) Greg Knaddison (greggles) Drew Webber (mcdruid) Juraj Nemec (poker10) Jess (xjm)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-3216",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-25T20:13:57.967836Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-27T13:58:20.679Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/canvas",
          "defaultStatus": "unaffected",
          "product": "Drupal Canvas",
          "repo": "https://git.drupalcode.org/project/canvas",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "1.1.1",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Drew Webber (mcdruid)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "B\u00c3\u00a1lint Kl\u00c3\u00a9ri (balintbrews)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Ignacio S\u00c3\u00a1nchez Holgueras (isholgueras)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Drew Webber (mcdruid)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Narendra Singh Rathore (narendrar)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Christian L\u00c3\u00b3pez Esp\u00c3\u00adnola (penyaskito)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Tim Plunkett (tim.plunkett)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Drew Webber (mcdruid)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jess  (xjm)"
        }
      ],
      "datePublic": "2026-02-25T18:51:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal Canvas allows Server Side Request Forgery.\u003cp\u003eThis issue affects Drupal Canvas: from 0.0.0 before 1.1.1.\u003c/p\u003e"
            }
          ],
          "value": "Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal Canvas allows Server Side Request Forgery.This issue affects Drupal Canvas: from 0.0.0 before 1.1.1."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-664",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-664 Server Side Request Forgery"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-25T15:24:17.937Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-017"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Drupal Canvas - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-017",
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-3216",
    "datePublished": "2026-03-25T15:24:17.937Z",
    "dateReserved": "2026-02-25T16:59:32.261Z",
    "dateUpdated": "2026-03-27T13:58:20.679Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-1553 (GCVE-0-2026-1553)

Vulnerability from cvelistv5 – Published: 2026-02-04 20:26 – Updated: 2026-02-04 21:21
VLAI?
Title
Drupal Canvas - Moderately critical - Access bypass - SA-CONTRIB-2026-006
Summary
Incorrect Authorization vulnerability in Drupal Drupal Canvas allows Forceful Browsing.This issue affects Drupal Canvas: from 0.0.0 before 1.0.4.
Severity ?
4.8 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE
  • CWE-863 - Incorrect Authorization
Assigner
References
Impacted products
Vendor Product Version
Drupal Drupal Canvas Affected: 0.0.0 , < 1.0.4 (semver)
Create a notification for this product.
Date Public ?
2026-01-28 17:28
Credits
jschref Bálint Kléri (balintbrews) Matt Glaman (mglaman) Christian López Espínola (penyaskito) Tim Plunkett (tim.plunkett) Alex Bronstein (effulgentsia) Greg Knaddison (greggles)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.8,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-1553",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-04T21:21:13.798297Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-04T21:21:35.681Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/canvas",
          "defaultStatus": "unaffected",
          "product": "Drupal Canvas",
          "repo": "https://git.drupalcode.org/project/canvas",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "1.0.4",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "jschref"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "B\u00c3\u00a1lint Kl\u00c3\u00a9ri (balintbrews)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Matt Glaman (mglaman)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Christian L\u00c3\u00b3pez Esp\u00c3\u00adnola (penyaskito)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Tim Plunkett (tim.plunkett)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Alex Bronstein (effulgentsia)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        }
      ],
      "datePublic": "2026-01-28T17:28:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Incorrect Authorization vulnerability in Drupal Drupal Canvas allows Forceful Browsing.\u003cp\u003eThis issue affects Drupal Canvas: from 0.0.0 before 1.0.4.\u003c/p\u003e"
            }
          ],
          "value": "Incorrect Authorization vulnerability in Drupal Drupal Canvas allows Forceful Browsing.This issue affects Drupal Canvas: from 0.0.0 before 1.0.4."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-87",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-87 Forceful Browsing"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-04T20:26:22.334Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-006"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Drupal Canvas - Moderately critical - Access bypass - SA-CONTRIB-2026-006",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-1553",
    "datePublished": "2026-02-04T20:26:22.334Z",
    "dateReserved": "2026-01-28T17:01:08.406Z",
    "dateUpdated": "2026-02-04T21:21:35.681Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}