CVE-2026-1554
Central Authentication System (CAS) Server - Less critical - XML Element Injection - SA-CONTRIB-2026-007
Summary
Central Authentication System (CAS) Server - Less critical - XML Element Injection - SA-CONTRIB-2026-007
Original description
The description as published by the source.
XML Injection (aka Blind XPath Injection) vulnerability in Drupal Central Authentication System (CAS) Server allows Privilege Escalation.This issue affects Central Authentication System (CAS) Server: from 0.0.0 before 2.0.3, from 2.1.0 before 2.1.2.
Affected packages
Packagist:https://packages.drupal.org/8
drupal/cas_server
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3"}],"database_specific":{"constraint":"<2.0.3"}},{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0"},{"fixed":"2.1.2"}],"database_specific":{"constraint":">=2.1.0 <2.1.2"}}]
References
- advisory github.com
- advisory nvd.nist.gov
- web drupal.org
- web git.drupalcode.org
- web drupal.org