A Cross‑Site Request Forgery vulnerability exists in Drupal Project Browser. The flaw allows an attacker to trick an authenticated user into performing privileged operations on the site without the user’s knowledge, potentially compromising confidentiality, integrity, or availability of the content. Based on the description, it is inferred that the attack vector involves a malicious link or form that the victim unknowingly visits, triggering a CSRF request (CWE-352).

Drupal Project Browser versions from 0.0.0 to 2.0.3, and from 2.1.0 to 2.1.5 are affected. No other vendors or products are listed as vulnerable.

The EPSS score is <1% and the CVSS score is 4.2, indicating moderate risk. The vulnerability is not listed in CISA KEV. Cross‑Site Request Forgery flaws are widely exploitable when an authenticated user is tricked into visiting a malicious link or form. The requirement for the victim to be logged in and for the browser to automatically include credentials indicates that the attack vector is inferred. The low exploitation probability does not reduce the need to patch promptly.