Theme Negotiation by Rules contains a Cross‑Site Request Forgery weakness that lets an attacker craft requests that are executed by a logged‑in user’s browser. Because the module does not validate the origin of submitted forms, a malicious site can trigger privileged actions on the Drupal site, such as changing theme settings or other configuration data. This flaw is classified as CWE‑352.

The vulnerability is present in Drupal installations that use the contributed module Theme Negotiation by Rules. All releases from version 0.0.0 up to, but not including, 1.2.1 are affected. The issue does not involve core Drupal code.

The advisory assigns a CVSS score of 4.3, indicating moderate severity, and an EPSS score of less than 1%, implying a low current exploitation probability. This flaw is not listed in the CISA KEV catalog, so no active weaponized attacks are reported. An attacker would need to entice a legitimate user to load a malicious page that submits a forged request, a common CSRF scenario. Consequently, any site that uses the affected module should treat the risk as moderate and address it promptly.