CVE-2026-1554
CVE-2026-1554 · Central Authentication System (CAS) Server - Less critical - XML Element Injection - SA-CONTRIB-2026-007
This page contains facts from public vulnerability sources. Check the original advisory before updating.
XML Injection (aka Blind XPath Injection) vulnerability in Drupal Central Authentication System (CAS) Server allows Privilege Escalation.This issue affects Central Authentication System (CAS) Server: from 0.0.0 before 2.0.3, from 2.1.0 before 2.1.2.
CVSS 4.2 · Medium · EPSS 0.2% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
central authentication system (cas) server
- Versions
- ≥ 0.0.0, < 2.0.3: Affected (semver)
- ≥ 2.1.0, < 2.1.2: Affected (semver)
Update to 2.0.3; Update to 2.1.2
drupal/cas_server Packagist:https://packages.drupal.org/8
- Affected ranges
- ECOSYSTEM: < 2.0.3
- ECOSYSTEM: ≥ 2.1.0, < 2.1.2
Update to 2.0.3; Update to 2.1.2