Project:
Project machine name:
project_browserDate:
2026-September-23
Vulnerability:
Cross-site request forgery
Affected versions:
<2.0.3 || >=2.1.0 <2.1.5
CVE IDs:
CVE-2026-96374
Description:
The Project Browser module enables you to apply recipes and enable modules from the web user interface.
The module doesn't sufficiently validate admin actions to protect against cross-site request forgery attacks (CSRF).
Solution:
Install the latest version:
- If you use the 2.1.x branch, upgrade to Project Browser 2.1.5.
- If you use the 2.0.x branch, upgrade to Project Browser 2.0.3.
Reported By:
Coordinated By:
- Swan Kalata (akalata) of the Drupal Security Team
- Bram Driesen (bramdriesen) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Drew Webber (mcdruid) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
