CVE-2026-4393
This module provides a site administrator the ability to log users out after a specified time of inactivity. The module doesn't sufficiently protect...
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
This module provides a site administrator the ability to log users out after a specified time of inactivity.
The module doesn't sufficiently protect its routes from cross-site request forgery (CSRF), allowing the logout route to be triggered without user interaction.
影響パッケージ
Packagist:https://packages.drupal.org/8
drupal/autologout
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0"}],"database_specific":{"constraint":"<1.7.0"}},{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.2"}],"database_specific":{"constraint":">=2.0.0 <2.0.2"}}]
参照URL
- web drupal.org