CVE-2026-13243

Critical · CVSS 9.8

Drupal Salesforce Suite — Cross-Site Request Forgery (CSRF)

CVSS: 9.8; nvd
EPSS: 0.10%; 1th pct
KEV: No
Class: oss containerizable; CWE-352

Description

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Salesforce Suite allows Cross Site Request Forgery. This issue affects Salesforce Suite versions: from 0.0.0 to 5.1.3.

Search profile — drives PoC discovery

Symbols drupal/salesforcesalesforce_suitesa-contrib-2026-063SalesforceAuthControllerSalesforceControllerdrupal_salesforce

Keywords CVE-2026-13243Drupal Salesforce Suite CSRFsa-contrib-2026-063drupal salesforce CSRF proof of conceptCWE-352 Drupal Salesforcedrupal/salesforce PoCSalesforce Suite 5.1.3 vulnerability

Versions: 0.0.0 to 5.1.3

Affected packages

Packagist:https://packages.drupal.org/8

drupal/salesforce

0 → 5.1.3

References

https://www.drupal.org/sa-contrib-2026-063

Status: enriched · ingested 2026-07-13T18:00:21.000Z · profiled 2026-07-13T18:30:21.000Z