Central Authentication System (CAS) Server - Less critical - XML Element Injection - SA-CONTRIB-2026-007
Priority LOW 19CWE-91Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.
Summary
XML Injection (aka Blind XPath Injection) vulnerability in Drupal Central Authentication System (CAS) Server allows Privilege Escalation.This issue affects Central Authentication System (CAS) Server: from 0.0.0 before 2.0.3, from 2.1.0 before 2.1.2.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00174 6th percentileScored 2026-11-07
Fix Fixed Central Authentication System (CAS) Server (Drupal): 2.0.3, 2.1.2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Drupal | Central Authentication System (CAS) Server | 0.0.0 to before 2.0.3; 2.1.0 to before 2.1.2 | 2.0.3, 2.1.2 | Patch available | CNA |
- Central Authentication System (CAS) Server VendorDrupal Affected 0.0.0 to before 2.0.3; 2.1.0 to before 2.1.2 Fixed in 2.0.3, 2.1.2 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:jtenman:central_authentication_system_server:*:*:*:*:*:drupal:*:* | before 2.0.3; 2.1.0 to before 2.1.2 | Vulnerable | Jtenman |
- cpe:2.3:a:jtenman:central_authentication_system_server:*:*:*:*:*:drupal:*:* Versions before 2.0.3; 2.1.0 to before 2.1.2 Vulnerable ·Jtenman
Remediation
- Fix · CNA Central Authentication System (CAS) Server (Drupal) Fixed in 2.0.3, 2.1.2
Timeline
- 2026-10-02 Threatist record created from CVE-2026-1554
- 2026-10-03 Alias added: GHSA-rgcm-m74w-vrfx
References
More Drupal vulnerabilities
- TI-2026-07979 Drupal core - Highly critical - SQL injection - SA-CORE-2026-004 KEVCVSS 3.1CRITICAL 9.8
- TI-2018-05494 Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004 KEVCVSS 3.1CRITICAL 9.8
- TI-2018-05493 Improper input validation in Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6… KEVCVSS 3.1CRITICAL 9.8
- TI-2020-10731 Unrestricted file upload in Drupal Core KEVCVSS 3.1HIGH 8.8
- TI-2019-04505 Drupal core - Highly critical - Remote Code Execution KEVCVSS 3.1HIGH 8.1
- TI-2020-17477 Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks… KEVCVSS 3.1HIGH 7.8
Sources
- CVE-2026-1554 · CVE Program
- CVE-2026-1554 · NVD
- FIRST EPSS
- GHSA-rgcm-m74w-vrfx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences