CVEFinder.io

CVE-2026-55807

ℹī¸ low
🔍 Scan for this CVE
Summary

Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal core allows Server Side Request Forgery. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*.

CVSS Score
3.1
Low
EPSS Score
0.1
Exploit Probability
Published Date
2026-07-10
First Seen: 2026-07-11
📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 2.1% of all 348,756 vulnerabilities in our database.

#341,599
Below average severity
Severity Percentile
đŸŽ¯ CISA SSVC Assessment Updated: Jul 13, 2026
🔍 Exploitation Status
None
No known exploits
⚙ī¸ Automatable
NO
Requires human interaction
đŸ’Ĩ Technical Impact
Partial
Limited system impact
🏆 Discovered By
Hamed Kohi (0xhamy) assaf alassaf (ama62) Albert Skibinski (askibinski) Jon Minder (ayalon) Lautaro Casanova (betah4k) Gabe Sullice (gabesullice) John Morahan (john morahan) Michael Winser (michaelwinser) nbanderson offensive-ai Francesco Placella (plach) quynh ho (qquynh) Himanshu Anand (unknownhad) Lee Rowlands (larowlan) (remediation developer) Dave Long (longwave) (remediation developer) Drew Webber (mcdruid) (remediation developer) Adam G-H (phenaproxima) (remediation developer) Sean Blommaert (seanb) (remediation developer) Benji Fisher (benjifisher) (coordinator) cilefen (cilefen) (coordinator) Damien McKenna (damienmckenna) (coordinator) Mori Sugimoto (dokumori) (coordinator) Greg Knaddison (greggles) (coordinator) Lee Rowlands (larowlan) (coordinator) Dave Long (longwave) (coordinator) Drew Webber (mcdruid) (coordinator) James Gilliland (neclimdul) (coordinator) Juraj Nemec (poker10) (coordinator) Jess (xjm) (coordinator)
SSVC data provided by CISA
Last Modified 2026-07-16
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE IDs (Weakness Types)
CWE-918

đŸ“Ļ Affected Products 4

Vendor Product Status Affected Versions
drupal drupal Affected
< 10.5.12
drupal drupal Affected
> 10.6.0 < 10.6.11
drupal drupal Affected
> 11.0.0 < 11.2.14
drupal drupal Affected
> 11.3.0 < 11.3.12

🔗 References 1

https://www.drupal.org/sa-core-2026-008
Vendor Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-55803 đŸ”ļ medium 5.9 0.2 Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allow... 2026-07-10
CVE-2026-55804 đŸ”ļ medium 5.9 0.2 Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allow... 2026-07-10
CVE-2026-55806 đŸ”ļ medium 5.9 0.2 URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Drupal core allows Content Spoofing. This is... 2026-07-10
CVE-2026-55808 đŸ”ļ medium 5.4 0.2 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core... 2026-07-10
CVE-2026-9082 ⛔ critical 9.8 88.3 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core... 2026-05-20
CVE-2026-6365 đŸ”ļ medium 6.1 0.2 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core... 2026-05-19
These CVEs affect the same products