Entity Share Websub - Moderately critical - Server-side request forgery (SSRF) - SA-CONTRIB-2026-097

Project:

Date:

2026-August-12

Security risk:

Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:All

Vulnerability:

Server-side request forgery (SSRF)

Affected versions:

<1.1.2

CVE IDs:

CVE-2026-73474

Description:

This module enables you to share content between sites in a hub - subscriber model.

Certain inputs were not sufficiently validated, allowing an attacker to achieve server-side request forgery attacks.

Solution:

Install the latest version:

If you use the Entity Share Websub module for Drupal 9.x or 10.x, upgrade to Entity Share Websub 1.1.2

Reported By:

Fixed By:

Coordinated By:

Contact and more information

The Drupal security team can be reached by email at security at drupal.org or via the contact form.

Follow the Drupal Security Team on Bluesky, or Mastodon or Linkedin.

The security team is made up of volunteers around the world. The companies above have sponsored time on this release.