{"id":"CVE-2026-73474","aliases":["DRUPAL-CONTRIB-2026-097","EUVD-2026-69991","GHSA-qgvw-q84r-4fxw"],"status":"published","title":"Entity Share Websub - Moderately critical - Server-side request forgery (SSRF) - SA-CONTRIB-2026-097","description":"Server-Side Request Forgery (SSRF) vulnerability in Drupal Entity Share Websub allows Server Side Request Forgery. This issue affects Entity Share Websub versions: from 0.0.0 to 1.1.2.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.0034,"percentile":0.27801,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-918"],"published":"2026-08-12T17:55:17Z","modified":"2026-10-28T02:30:27Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/entity_share_websub","fixed_in":["1.1.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/entity_share_websub","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2"}]}]}],"products":[{"vendor":"drupal","product":"entity share websub"},{"vendor":"entity_share_websub_project","product":"entity_share_websub"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2026-097","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73474","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-qgvw-q84r-4fxw"},{"url":"https://git.drupalcode.org/project/entity_share_websub","tags":["web"]},{"url":"https://www.drupal.org/project/entity_share_websub","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73474.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-73474","title":"Entity Share Websub - Moderately critical - Server-side request forgery (SSRF) - SA-CONTRIB-2026-097","description":"Server-Side Request Forgery (SSRF) vulnerability in Drupal Entity Share Websub allows Server Side Request Forgery. This issue affects Entity Share Websub versions: from 0.0.0 to 1.1.2.","status":"published","published":"2026-09-02T12:32:39.821Z","modified":"2026-09-02T18:37:02.961Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T13:43:33.766176Z"}],"euvd":[{"id":"EUVD-2026-69991","description":"Server-Side Request Forgery (SSRF) vulnerability in Drupal Entity Share Websub allows Server Side Request Forgery. This issue affects Entity Share Websub versions: from 0.0.0 to 1.1.2.","status":"published","published":"2026-09-02T12:32:39Z","modified":"2026-09-02T18:37:02Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T18:01:14.689075Z"}],"ghsa":[{"id":"GHSA-qgvw-q84r-4fxw","title":"Server-Side Request Forgery (SSRF) vulnerability in Drupal Entity Share Websub allows Server Side...","description":"Server-Side Request Forgery (SSRF) vulnerability in Drupal Entity Share Websub allows Server Side Request Forgery. This issue affects Entity Share Websub versions: from 0.0.0 to 1.1.2.","status":"published","published":"2026-09-02T15:34:46Z","modified":"2026-09-02T21:32:02Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:11:17.943368Z"}],"nvd":[{"id":"CVE-2026-73474","description":"Server-Side Request Forgery (SSRF) vulnerability in Drupal Entity Share Websub allows Server Side Request Forgery. This issue affects Entity Share Websub versions: from 0.0.0 to 1.1.2.","status":"published","published":"2026-09-02T13:18:08.187Z","modified":"2026-09-09T18:20:30.503Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:12:43.399612Z"}],"osv":[{"id":"CVE-2026-73474","title":"Entity Share Websub - Moderately critical - Server-side request forgery (SSRF) - SA-CONTRIB-2026-097","description":"Server-Side Request Forgery (SSRF) vulnerability in Drupal Entity Share Websub allows Server Side Request Forgery. This issue affects Entity Share Websub versions: from 0.0.0 to 1.1.2.","status":"published","published":"2026-09-02T12:32:39.821Z","modified":"2026-10-28T02:30:27.700968092Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:45:16.365946Z"},{"id":"DRUPAL-CONTRIB-2026-097","description":"This module enables you to share content between sites in a hub - subscriber model.\n\nCertain inputs were not sufficiently validated, allowing an attacker to achieve server-side request forgery attacks.","status":"published","published":"2026-08-12T17:55:17Z","modified":"2026-08-12T19:59:13.596333Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}