Drupal Automated Logout Extension Vulnerability Allows File Manipulation

CERT-Bund has released security advisory WID-SEC-2026-0781 detailing a critical vulnerability in the Drupal Automated Logout Extension. This flaw, with a CVSS Base Score of 5.3, enables remote, anonymous attackers to manipulate files on affected systems. The advisory specifically identifies Open Source Drupal Automated Logout versions prior to 1.7.0 and prior to 2.0.2 as vulnerable.

Organizations utilizing Drupal with the affected Automated Logout Extension must take immediate action to mitigate this risk. While the advisory indicates mitigation is available, specific steps are not detailed in this summary. It is crucial for IT security teams to identify the affected Drupal installations, apply available patches or workarounds, and monitor for any signs of exploitation. Failure to address this vulnerability could lead to unauthorized file manipulation and potential compromise of system integrity.