CVE-2026-1554 Central Authentication System (CAS) Server - Less critical - XML Element Injection - SA-CONTRIB-2026-007
An XML injection vulnerability in the Drupal CAS Server module allows attackers to escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-1554?
CVE-2026-1554 is a medium-severity vulnerability in Drupal Central Authentication System (CAS) Server, published on 4 Feb 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
XML Injection (aka Blind XPath Injection) vulnerability in Drupal Central Authentication System (CAS) Server allows Privilege Escalation.This issue affects Central Authentication System (CAS) Server: from 0.0.0 before 2.0.3, from 2.1.0 before 2.1.2.
Weakness: CWE-91
Which versions are affected by CVE-2026-1554?
It affects 1 product.
Linux distribution packages (1)
drupal/cas_server Packagist:https://packages.drupal.org/8 | All versions | 2.0.3, 2.1.2 |
Products include Jtenman Central Authentication System Server.
How do I fix CVE-2026-1554?
Upgrade to a fixed version.
Is CVE-2026-1554 being exploited?
There is no known exploitation of CVE-2026-1554 in the wild and no public exploit code.
Sources
Also known as DRUPAL-CONTRIB-2026-007, GHSA-rgcm-m74w-vrfx.