{"id":"CVE-2026-13243","aliases":["DRUPAL-CONTRIB-2026-063","EUVD-2026-43067","GHSA-585m-5jj4-5474"],"status":"published","title":"Salesforce Suite - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-063","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Salesforce Suite allows Cross Site Request Forgery. This issue affects Salesforce Suite versions: from 0.0.0 to 5.1.3.","severity":{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00122,"percentile":0.02014,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-352"],"published":"2026-06-24T18:48:15Z","modified":"2026-10-28T02:30:51Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/salesforce","fixed_in":["5.1.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/salesforce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.3"}]}]}],"products":[{"vendor":"drupal","product":"salesforce suite"},{"vendor":"victorkane","product":"salesforce_suite"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2026-063","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13243","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-585m-5jj4-5474"},{"url":"https://git.drupalcode.org/project/salesforce","tags":["web"]},{"url":"https://www.drupal.org/project/salesforce","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/13xxx/CVE-2026-13243.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-13243","title":"Salesforce Suite - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-063","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Salesforce Suite allows Cross Site Request Forgery. This issue affects Salesforce Suite versions: from 0.0.0 to 5.1.3.","status":"published","published":"2026-07-10T21:44:55.591Z","modified":"2026-07-13T17:53:29.708Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:19:49.885652Z"}],"euvd":[{"id":"EUVD-2026-43067","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Salesforce Suite allows Cross Site Request Forgery. This issue affects Salesforce Suite versions: from 0.0.0 to 5.1.3.","status":"published","published":"2026-07-10T21:44:55Z","modified":"2026-07-13T17:53:29Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:20:01.134466Z"}],"ghsa":[{"id":"GHSA-585m-5jj4-5474","title":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Salesforce Suite allows Cross Site...","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Salesforce Suite allows Cross Site Request Forgery. This issue affects Salesforce Suite versions: from 0.0.0 to 5.1.3.","status":"published","published":"2026-07-11T00:31:47Z","modified":"2026-07-13T18:31:41Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:09:25.900925Z"}],"nvd":[{"id":"CVE-2026-13243","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Salesforce Suite allows Cross Site Request Forgery. This issue affects Salesforce Suite versions: from 0.0.0 to 5.1.3.","status":"published","published":"2026-07-10T22:16:40.42Z","modified":"2026-10-25T15:10:00.147Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:12:28.771746Z"}],"osv":[{"id":"CVE-2026-13243","title":"Salesforce Suite - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-063","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Salesforce Suite allows Cross Site Request Forgery. This issue affects Salesforce Suite versions: from 0.0.0 to 5.1.3.","status":"published","published":"2026-07-10T21:44:55.591Z","modified":"2026-10-28T02:30:51.292574823Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:44:57.354194Z"},{"id":"DRUPAL-CONTRIB-2026-063","description":"The Salesforce Suite of modules integrates Drupal with Salesforce.\n\nThe Salesforce module does not properly validate the OAuth handshake during interactive authentication, allowing an attacker to hijack the authorization token and bind the site to an attacker's Salesforce account.\n\nThis vulnerability is mitigated by the fact that `salesforce_oauth` submodule must be enabled, and a `salesforce_oauth` authorization profile active and in use. The submodule `salesforce_oauth` is deprecated, and `salesforce_jwt` has been the recommended authentication plugin for several years. Sites with `salesforce_oauth` uninstalled, or sites relying exclusively on `salesforce_jwt` (JWT or JWT Gov Cloud) for authentication are not impacted.\n\nSubmodule salesforce\\_oauth has been removed in branch 6.0.x, so \u003e= 6.0.x versions are not affected by this vulnerability.","status":"published","published":"2026-06-24T18:48:15Z","modified":"2026-09-10T03:45:59.732985654Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}