PatchClock

PHP security digest · 23 Sep 2026

The Project Browser module enables you to apply recipes and enable modules from the web user interface. The module doesn't sufficiently validate admin actions...

Unrated CVE-2026-96374

Package
drupal/project_browser
Fixed in
2.0.3, 2.1.5
Published
Wed 23 Sep 2026, 17:53 LisbonUpdated Mon 26 Oct 2026, 02:26 Lisbon

In plain words

Project Browser does not sufficiently validate admin actions to protect against cross-site request forgery (CSRF). This can let an attacker cause an administrator to carry out unwanted actions through the web interface, where the module supports applying recipes and enabling modules.

Am I affected?

Look for drupal/project_browser and its version in composer.lock. The advisory lists fixes in 2.0.3 and 2.1.5, but gives no affected version range, so it does not establish which other versions are affected. It names no configuration or database condition beyond use of the module and its admin actions.

What to do

Check which version you have, then update to a fixed release for your branch (2.0.3, 2.1.5):

composer show drupal/project_browser | grep versions
composer update drupal/project_browser

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

The advisory's description

The Project Browser module enables you to apply recipes and enable modules from the web user interface.

The module doesn't sufficiently validate admin actions to protect against cross-site request forgery attacks (CSRF).

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.