CVE-2015-4360: Cross-site request forgery (CSRF) vulnerability in the Registration codes module before 6.x-1.6, 6.x-2.x be...

Security readout for executives and security teams

CVE-2015-4360 affects the Drupal Registration codes contributed module. It allows cross-site request forgery against administrators, potentially causing role-rules to be deleted if an authenticated admin is tricked into making a malicious request. No active exploitation is indicated in the provided sources. Exposure is limited to Drupal sites using the Registration codes module in the affected version ranges. Risk is highest where administrators are active in the site and role-rule integrity matters for registration workflows. Treat as a routine but timely remediation for Drupal environments using this module. It is not supported as actively exploited, but it can affect administrative configuration integrity if admins are tricked. Mitigation focus: Upgrade Registration codes to 6.x-1.6, 6.x-2.8, 7.x-1.2, or later as applicable.; Review the linked Drupal advisory for version-specific guidance.; Limit administrator browsing exposure while logged into Drupal administration sessions..

Prepared

Jun 13, 2026, 23:11 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.