CVE-2026-55806— Drupal core - Less critical - Cache poisoning and open redirect - SA-CORE-2026-007
Possible ATT&CK Techniques 1AI
T1566.002 · Spearphishing LinkGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-55806
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Drupal core - Less critical - Cache poisoning and open redirect - SA-CORE-2026-007
Source: NVD (National Vulnerability Database)
Vulnerability Description
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Drupal core allows Content Spoofing. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
指向未可信站点的URL重定向(开放重定向)
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Drupal | Drupal core | 0.0.0 ~ 10.5.12 | - |
II. Public POCs for CVE-2026-55806
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-55806
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-55806 (1)
Same Patch Batch · Drupal · 2026-07-10 · 46 CVEs total
| CVE-2026-13232 | Advanced Content Feedback (aka admin_feedback) - Moderately critical - Access bypass / Ins | |
| CVE-2026-55807 | Drupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-008 | |
| CVE-2026-55810 | Plotly.js Graphing - Critical - PHP object injection - SA-CONTRIB-2026-050 | |
| CVE-2026-15087 | Clean RESTful - Critical - Unsupported - SA-CONTRIB-2026-078 | |
| CVE-2026-15089 | Commerce guest registration - Critical - Unsupported - SA-CONTRIB-2026-079 | |
| CVE-2026-11915 | Brute force attack protection - Critical - Unsupported - SA-CONTRIB-2026-047 | |
| CVE-2026-11913 | Mother May I - Critical - Unsupported - SA-CONTRIB-2026-045 | |
| CVE-2026-11914 | Composer - Critical - Unsupported - SA-CONTRIB-2026-046 | |
| CVE-2026-15086 | Raw Formatter [Meta Tag Formatter] - Critical - Unsupported - SA-CONTRIB-2026-077 | |
| CVE-2026-55808 | Drupal core - Moderately critical - Improper validation - SA-CORE-2026-009 | |
| CVE-2026-55804 | Drupal core - Moderately critical - Gadget chain - SA-CORE-2026-006 | |
| CVE-2026-13234 | AI (Artificial Intelligence) - Moderately critical - Information Disclosure / Cross-site S | |
| CVE-2026-13239 | WissKI - Critical - Access bypass - SA-CONTRIB-2026-059 | |
| CVE-2026-13237 | AI Agents - Moderately critical - Information disclosure, Access bypass - SA-CONTRIB-2026- | |
| CVE-2026-13233 | OpenAI Provider - Moderately critical - Server-side Request Forgery - SA-CONTRIB-2026-053 | |
| CVE-2026-13236 | AI Agents - Less critical - Access bypass - SA-CONTRIB-2026-056 | |
| CVE-2026-13238 | Commerce Realex / Global Payments - Moderately critical - Access Bypass - SA-CONTRIB-2026- | |
| CVE-2026-13241 | Paragraphs - Moderately critical - Access bypass - SA-CONTRIB-2026-061 | |
| CVE-2026-13240 | Paragraphs - Less critical - Access bypass - SA-CONTRIB-2026-060 | |
| CVE-2026-13244 | Tealium iQ Tag Management - Critical - PHP object injection - SA-CONTRIB-2026-064 |
Showing top 20 of 46 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Drupal core
- CVE-2026-55808
Drupal core - Moderately critical - Improper validation - SA - CVE-2026-55807
Drupal core - Moderately critical - Server-side request forg - CVE-2026-55804
Drupal core - Moderately critical - Gadget chain - SA-CORE-2 - CVE-2026-55803
Drupal core - Critical - PHP object injection - SA-CORE-2026 - CVE-2026-9082
Drupal core - Highly critical - SQL injection - SA-CORE-2026
Same vendor: Drupal
- CVE-2026-11913
Mother May I - Critical - Unsupported - SA-CONTRIB-2026-045 - CVE-2026-11914
Composer - Critical - Unsupported - SA-CONTRIB-2026-046 - CVE-2026-11915
Brute force attack protection - Critical - Unsupported - SA- - CVE-2026-15087
Clean RESTful - Critical - Unsupported - SA-CONTRIB-2026-078 - CVE-2026-15086
Raw Formatter [Meta Tag Formatter] - Critical - Unsupported
Same weakness: CWE-601
- CVE-2026-55461
Snipe-IT: Open Redirect After User Edit - CVE-2026-55590
CakePHP: Open redirect weakness via backslash bypass - CVE-2026-31982
Open Redirect in SAML Single Sign-On in Guardian/CMC before - CVE-2026-59806
Gradio < 6.20.0 - Open Redirect and SSRF via /gradio_api/fil - CVE-2026-14632
kirilkirkov Ecommerce-CodeIgniter-Bootstrap Trusted Backend
V. Comments for CVE-2026-55806
No comments yet