The vulnerability is a server‑side request forgery that allows an attacker to instruct the Drupal server to make arbitrary HTTP requests, potentially reaching internal resources or services exposed behind the firewall. Because the attacker can control the target URL, the impact may include exposing sensitive data, triggering unintended actions on internal systems, or facilitating further compromise by accessing privileged resources. This flaw is categorized as CWE‑918 and manifests as a lack of proper validation or sanitization of user‑supplied URLs.

The Drupal "Entity Share Websub" module is vulnerable from version 0.0.0 through 1.1.2 inclusive. Any system running any of those releases is affected and must verify its installed version to determine risk.

No EPSS score is published and the vulnerability is not in the CISA KEV catalog, so the public exploitation likelihood is unknown. However, the nature of SSRF and its potential to reach internal assets makes this a high‑risk issue for environments where the Drupal instance can trust untrusted input. The attack vector is inferred to be remote, where an attacker can influence the subscription URL or similar input that the module processes to perform outbound requests. The CVSS score of 5.3 indicates moderate severity.