CVE-2015-4361: Cross-site request forgery (CSRF) vulnerability in the Registration codes module before 6.x-1.6 for Drupal...

Security readout for executives and security teams

A malicious site could cause a signed-in Drupal administrator’s browser to delete registration codes in the Drupal Registration codes module. The likely business impact is disruption to user registration or onboarding workflows that depend on those codes, not direct server takeover based on the supplied evidence. Exposure is likely limited to Drupal 6 sites using the contributed Registration codes module below 6.x-1.6. The provided affected-product metadata is incomplete, so confirm by checking installed Drupal modules and their exact versions. Prioritize remediation for Drupal environments where registration codes control onboarding, access, or customer workflows. This is not evidenced as actively exploited, but it can disrupt business processes if an administrator is targeted. Mitigation focus: Update the Registration codes module to 6.x-1.6 or later where applicable.; Review the Drupal advisory for exact vendor remediation guidance.; Restrict Drupal administrator access to trusted users only..

Prepared

Jun 13, 2026, 22:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.