CVE-2026-15080: Drupal Ray Enterprise Translation CSRF

CVE-2026-15080 Overview

CVE-2026-15080 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] affecting the Drupal Ray Enterprise Translation contributed module. The flaw allows an attacker to trigger unintended state-changing actions on behalf of an authenticated Drupal user who visits an attacker-controlled page. Exploitation requires user interaction over the network and can result in limited integrity impact without affecting confidentiality or availability.

Affected releases include Ray Enterprise Translation 0.0.0 through 4.0.4, 4.1.0 through 4.1.4, and 11.0.0 through 11.0.4. The Drupal Security Team published the coordinated advisory covering the module maintainers' fix.

Critical Impact
An attacker can coerce an authenticated Drupal user into executing unauthorized translation-related actions by visiting a malicious page, undermining the integrity of site content.

Affected Products

Drupal Ray Enterprise Translation versions 0.0.0 to 4.0.4
Drupal Ray Enterprise Translation versions 4.1.0 to 4.1.4
Drupal Ray Enterprise Translation versions 11.0.0 to 11.0.4

Discovery Timeline

2026-07-10 - CVE-2026-15080 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-15080

Vulnerability Analysis

The Ray Enterprise Translation module exposes one or more state-changing endpoints that do not require or validate an anti-CSRF token. When a Drupal user with permissions to use the module visits a page controlled by an attacker, the browser automatically attaches session cookies to forged requests aimed at the vulnerable endpoint. The Drupal application processes those requests as if the user issued them intentionally.

The attack requires user interaction, which is why the impact is scoped to integrity. Confidentiality and availability remain unaffected because the vulnerable actions modify translation-related data rather than exposing sensitive information or degrading service. The scope remains unchanged, meaning the attack executes within the privileges already held by the targeted user account.

Root Cause

The root cause is missing or incomplete CSRF protection [CWE-352] on module routes that perform state changes. Drupal provides token-based CSRF defenses through the csrf_token route requirement and Drupal\Core\Access\CsrfTokenGenerator, but the vulnerable versions of Ray Enterprise Translation did not enforce these controls on all applicable endpoints.

Attack Vector

Exploitation is network-based and requires that a targeted authenticated user visit an attacker-controlled page or click a crafted link. The malicious page issues a forged HTTP request such as an auto-submitting form or an image tag targeting the vulnerable module endpoint. The victim's browser transmits the authenticated session cookie, and the Drupal site accepts the request. No code example is published; refer to the Drupal Security Advisory for technical specifics.

Detection Methods for CVE-2026-15080

Indicators of Compromise

Unexpected changes to translation configuration or content originating from legitimate user sessions.
HTTP POST or GET requests to Ray Enterprise Translation endpoints carrying Referer headers pointing to external, untrusted domains.
Web server access logs showing state-changing module requests without preceding navigation from an internal Drupal admin page.

Detection Strategies

Review Drupal watchdog and web server logs for module actions that lack a valid CSRF token parameter.
Correlate user session activity with browser navigation patterns to flag cross-origin request bursts.
Compare installed module versions against fixed releases using drush pm:list or the Drupal admin reports page.

Monitoring Recommendations

Enable and centralize Drupal logging, forwarding events to a SIEM for correlation across user activity and HTTP requests.
Monitor for anomalous Referer and Origin header values on requests to /admin and Ray Enterprise Translation routes.
Alert on modifications to translation entities performed outside expected editor workflows.

How to Mitigate CVE-2026-15080

Immediate Actions Required

Upgrade Ray Enterprise Translation to a fixed release above 4.0.4, 4.1.4, or 11.0.4 as applicable to your major version branch.
Audit user permissions and revoke module access for accounts that do not require translation capabilities.
Force a session reset for privileged users after applying the patch to invalidate any pre-existing forged workflows.

Patch Information

The Drupal Security Team published fixed releases in coordination with the module maintainers. Consult the Drupal Security Advisory for the specific patched versions and upgrade instructions. Sites should apply the update through their standard Composer or Drush workflow and clear the Drupal cache after deployment.

Workarounds

If immediate patching is not possible, disable the Ray Enterprise Translation module using drush pm:uninstall ray_enterprise_translation until the upgrade can be applied.
Restrict access to module endpoints via a web application firewall rule that requires a matching Origin or Referer header.
Enforce SameSite=Strict on Drupal session cookies to reduce cross-site request success rates.

bash

# Configuration example
composer update drupal/ray_enterprise_translation --with-dependencies
drush updatedb -y
drush cache:rebuild