CVE-2026-13243 Salesforce Suite - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-063
Attackers can trick authenticated users into performing unwanted actions in the Drupal Salesforce Suite module.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-13243?
CVE-2026-13243 is a medium-severity vulnerability in Drupal Salesforce Suite, published on 10 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Salesforce Suite allows Cross Site Request Forgery. This issue affects Salesforce Suite versions: from 0.0.0 to 5.1.3.
Weakness: CWE-352
Which versions are affected by CVE-2026-13243?
It affects 1 product.
Linux distribution packages (1)
drupal/salesforce Packagist:https://packages.drupal.org/8 | All versions | 5.1.3 |
Products include Victorkane Salesforce Suite.
How do I fix CVE-2026-13243?
Upgrade to a fixed version.
Is CVE-2026-13243 being exploited?
There is no known exploitation of CVE-2026-13243 in the wild and no public exploit code.
Sources
Also known as DRUPAL-CONTRIB-2026-063, GHSA-585m-5jj4-5474.