CVE-2015-4390: Multiple cross-site request forgery (CSRF) vulnerabilities in the User Import module 6.x-4.x before 6.x-4.4...

Security readout for executives and security teams

This CVE affects the Drupal User Import contributed module. If an administrator is logged in, a remote attacker could abuse CSRF to make that administrator unknowingly continue or delete an ongoing user import. Business impact depends on whether the module is installed and whether privileged users manage imports. Exposure is likely limited to Drupal sites using the User Import module in the affected 6.x or 7.x branches, especially where administrators run import workflows while logged in. Treat as a targeted CMS administration risk, not an internet-wide emergency. Patch affected Drupal sites during the next maintenance window, faster where user imports are operationally important. Mitigation focus: Upgrade User Import 6.x-4.x deployments to 6.x-4.4 or later.; Upgrade User Import 7.x-2.x deployments to 7.x-2.3 or later.; Review the linked Drupal advisories for branch-specific update guidance..

Prepared

Jun 13, 2026, 22:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.