CVE-2026-1554CWE-91

Central Authentication System (CAS) Server - Less critical - XML Element Injection - SA-CONTRIB-2026-007

Medium · published February 4, 2026

CVSS v3.1
4.2
EPSS
0%
Percentile
6.8
In the wild
Unconfirmed
What it is

XML Injection (aka Blind XPath Injection) vulnerability in Drupal Central Authentication System (CAS) Server allows Privilege Escalation.This issue affects Central Authentication System (CAS) Server: from 0.0.0 before 2.0.3, from 2.1.0 before 2.1.2.

The record
Technical detail
CVSS v3.1
4.2 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00176 · 6.8th percentile
Weakness
CWE-91 · XML Injection (aka Blind XPath Injection)
Published
2026-02-04T20:26Z
EPSS history
Timeline
  • 04 FEB 20:26Z
    Central Authentication System (CAS) Server - Less critical - XML Element Injection - SA-CONTRIB-2026-007
    cvelistv5