Project: 
Campaign Monitor
Project machine name: 
campaignmonitor
Date: 
2026-November-11
Security risk: 
Moderately critical 12 ∕ 25 AC:Complex/A:None/CI:None/II:Some/E:Theoretical/TD:All
Vulnerability: 
Cross-site request forgery
Affected versions: 
<3.0.3
CVE IDs: 
CVE-2026-126735
Description: 

This module integrates the Campaign Monitor API into Drupal so that users can subscribe and unsubscribe for your Campaign Monitor. It manages lists through a block on your Drupal site.

The module doesn't sufficiently protect against cross-site request forgery (CSRF) on its admin routes.

This vulnerability is mitigated by the fact that an attacker must craft and embed into a Drupal site a link with exact ID of a Campaign Monitor list for user with administer campaignmonitor permission to click.

Solution: 

Install the latest version:

Reported By: 
Fixed By: 
Coordinated By: