{"id":"CVE-2026-55806","published":"2026-07-10T21:46:39Z","modified":"2026-07-13T18:22:03Z","title":"Drupal core - Less critical - Cache poisoning and open redirect - SA-CORE-2026-007","vendor":"Drupal","product":"Drupal core","tier":"tail","description":{"text":"URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Drupal core allows Content Spoofing. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.9,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.00339,"percentile":0.27259,"provenance":"source"},"cwes":[{"id":"CWE-601","name":"URL Redirection to Untrusted Site"}],"references":[{"url":"https://www.drupal.org/sa-core-2026-007","tags":[]}],"priority":{"score":9.6,"factors":[{"name":"EPSS percentile","points":5.45},{"name":"CVSS severity","points":4.13}]},"vendorSlug":"drupal","affectedVersions":[{"vendor":"Drupal","product":"Drupal core","versions":[">= 0.0.0, < 10.5.12",">= 10.6.0, < 10.6.11",">= 11.2.0, < 11.2.14",">= 11.3.0, < 11.3.12",">= 0.0.0, < 11.0.*",">= 0.0.0, < 11.1.*"]}],"affected":[{"ecosystem":"Packagist","package":"drupal/core","vulnerableRanges":["<10.5.12",">=10.6.0, <10.6.11",">=11.2.0, <11.2.14",">=11.3.0, <11.3.12",">=11.0.0, <11.1.0",">=11.1.0, <11.2.0"],"patched":["10.5.12","10.6.11","11.2.14","11.3.12","11.1.0","11.2.0"],"from":["DRUPAL-CORE-2026-007"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-43083","exploited":false,"provenance":"source"}}